evilquest | dffddb238fea6ff39a573ecbc2c0a78a875f895f99d1755f7976397d9ed4c2ac

Analysis

max time kernel
150s
max time network
133s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
06-04-2024 04:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-06_6229e75725065524688f77041d2fd304_adload_evilquest
Size

182KB
MD5

6229e75725065524688f77041d2fd304
SHA1

8fb3b6476309ef30e05ed1a84d81ad59aa45b2e3
SHA256

dffddb238fea6ff39a573ecbc2c0a78a875f895f99d1755f7976397d9ed4c2ac
SHA512

825182101bb24897feab15de6d0d03fd06fe6f9a2cbc78cb24401177a5753e69a28db7fdd9300abbcc70111feb60a78eeec23262025401faa40658ab62144bd6
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq920wl9:5SeOQdaZNxtk8cqhSxvHY9C7

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008af43-3.dat	family_evilquest
behavioral1/files/0x000000030008aede-6.dat	family_evilquest
behavioral1/files/0x000000030008af43-9.dat	family_evilquest
behavioral1/files/0x000000030008af43-20.dat	family_evilquest
behavioral1/files/0x000000030008af43-32.dat	family_evilquest
behavioral1/files/0x000000030008af6e-41.dat	family_evilquest
behavioral1/files/0x000000030008af43-50.dat	family_evilquest
behavioral1/files/0x000000030008af43-57.dat	family_evilquest
behavioral1/files/0x000000030008af43-64.dat	family_evilquest
behavioral1/files/0x000000030008af43-71.dat	family_evilquest
behavioral1/files/0x000000030008af43-78.dat	family_evilquest
behavioral1/files/0x000000030008af43-85.dat	family_evilquest
behavioral1/files/0x000000030008af43-92.dat	family_evilquest
behavioral1/files/0x000000030008af43-99.dat	family_evilquest
behavioral1/files/0x000000030008af43-106.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 50 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"

Launchctl 1 TTPs 64 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:529

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:529

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-06_6229e75725065524688f77041d2fd304_adload_evilquest\""
1⤵
PID:530

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-06_6229e75725065524688f77041d2fd304_adload_evilquest\""
1⤵
PID:530

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-04-06_6229e75725065524688f77041d2fd304_adload_evilquest
1⤵
PID:530
- /bin/zsh
  /bin/zsh -c /Users/run/2024-04-06_6229e75725065524688f77041d2fd304_adload_evilquest
  2⤵
  PID:533
- /Users/run/2024-04-06_6229e75725065524688f77041d2fd304_adload_evilquest
  /Users/run/2024-04-06_6229e75725065524688f77041d2fd304_adload_evilquest
  2⤵
  PID:533

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:534

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:534

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.secd
1⤵
PID:541

/usr/libexec/secd
/usr/libexec/secd
1⤵
PID:541

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:542

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:543

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:543

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:542

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:543

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:544

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:544

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:545

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:545

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:545

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:546

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:546
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:549

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:547

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:547

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:547

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:548

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:548

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:548

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:550

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:550

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:550

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:551

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:551

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:553

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:554

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:554

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:576

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:577

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:577

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:582

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:582
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:583

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:584

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:584

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:584

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:586

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:586

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:586

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:587

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:587

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:587

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:588

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:588

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:588

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:589

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:589

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:590

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:590

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:590

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:591

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:591

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:592

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:593

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:593

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:593

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:594

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:594

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:594

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:592

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:595

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:595

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:596

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:598

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:600

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:601

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:601
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:602

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:603

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:603

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:604

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:605

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:606

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:612

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:612
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:613

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:614

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:614

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:614

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:615

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:615

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:615

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:616

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:616

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:616

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:617

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:617

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:617

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:618

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:618

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:619

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:619
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:620

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:621

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:621

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:621

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:622

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:622

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:622

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:623

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:623

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:623

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:624

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:624

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:624

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:625

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:625

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:625

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:626

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:626

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:626

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:627

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:627

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:627

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:629

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:629

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:629

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:630

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:630

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:630

/bin/sh
sh -c "ileges\""
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:633

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:633
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:634

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:635

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:635

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:635

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:636

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:636

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:636

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:637

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:637

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:637

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:638

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:638

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:638

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:639

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:639

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:640

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:640
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:641

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:642

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:642

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:642

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:643

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:644

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:645

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:645
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:646

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:647

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:648

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:648

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:648

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:649

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:649

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:649

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:650

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:650

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:650

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:651

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:651

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:651

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:652

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:652
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:653

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:654

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:654

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:654

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:655

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:655

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:655

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:656

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:656

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:656

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:657

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:657

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:657

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:658

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:658

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:658

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:659

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:659

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:659

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:660

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:660

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:660

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:661

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:661

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:661

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:662

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:662

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:662

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:663

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:663
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:664

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:665

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:665

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:665

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:669

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:669
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:670

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:671

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:671

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:671

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:672

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:673

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:673
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:674

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:675

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:675

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:675

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:676

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:676

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:677

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:677
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:678

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:679

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:679

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:679

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:680

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:681

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:681
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:682

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:683

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:683

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:683

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:684

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:684

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:684

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:685

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:685

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:685

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:686

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:686

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:686

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:687

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:687

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:687

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:688

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:688
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:689

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:690

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:690

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:690

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
76ca6a81ac250adcc5a4e8b8db9651bc

SHA1
836639b6e5ca43e3e12ac1e192cf388a616157db

SHA256
adbde6b9a29cc81d53a14cb18a25b33533eb88071c4474742ecc0f4b5c167e1f

SHA512
6b8decbbbc767ae9b224dba1905813fbdc32109fbe7eceeadb54f14575be8b701c642a222d5b44899729a17f933fd2589411820b9e0fcac60a16f80935c84d61

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
714c850b9cb2242ea6a0bf35a5f97980

SHA1
c9424372bb0855a26ae0827c4c0bd1982cf99097

SHA256
9943128c5085c1724909ba68b112cc6ad75a84e03ba1dca35f32909cf74eefcd

SHA512
6db43aaafd4d2506fa9796eb4aeecc0ce7460f87ae57ecc3e58d30625fea3b3a9e098e4b6c115892a5a288e74e6cbfd51a3857fa120024e6f48458cea872e437

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
4b09a698ae1b21bb5a674c96dc5f67e2

SHA1
71c41ea754c129cbc4833e90e184439d376e713d

SHA256
eb87a05ef669f2204d1354adcbdcf5141761ca251d45817c458d61e39b0494ca

SHA512
e9b93ea77241ac78b114723120d51b505d66f0549302aebec131b624a1d31561db588ad266b52a882b4748a97393efb29433c7f2d713f3d56e4ba7ae7937bea5

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
36412f5ed428e58a6b8d975f41abb0b3

SHA1
f1f177c445287405e40f58bdc7c13ef061e215d1

SHA256
042782ae51ad86c8c59ccdf24a9d34346d8a5287997947b49097ee10597a3494

SHA512
c42596e463d14c6f7915a3aef5881c790cce1bb9984c8a908bc7efc5d43ba95ac4b46f223b1a43e0454e1bc860c44d7ccf340f6b7cd7c434ef4695764221368f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
b70127e0f3b52af046cf34076936eed9

SHA1
dab79b22540e391752ab9374c36f8f563775969a

SHA256
8f7b84626351f3441e6d9112221724fb6e1c504ef16eb8e3c0e3a416c2e8d3e3

SHA512
d3a6d12780395e7a09d4b16a4341b00cd6ad7419aaea51451a31e7bf46eaf4d26573d7895e7db627f810cb6d510546dcb25ed9eebb04c1649a39fdf486d90a72

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
bf732f7569db9583afef68680209bfdf

SHA1
8578c462a7490371ec3d5cb3b0637595e719219a

SHA256
e69acbe7d440b90216debec21a82801fd23dcb8938945e7c95e725d6ae79d260

SHA512
cb7ea9f0d5d1b66e68be6c6c1bbd79fa06e700b8ecdc3dbf55ba9a495b1f1867024e538aced35526f7becbbb423530dde5c3384dbe492852002a921afe5d7d10

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
be2cce723f11c900efc21e6825e3e71a

SHA1
4bbf2c2b95caffe2bbfce0b8302afc69216ab77d

SHA256
43c7986e47915a2b45a2f323ff57dcfbd7a70da161bded6a8b6c11fa1658b591

SHA512
26b29731c9a43bbfbd15eff7e430a364c1bf60db5fab52e9a0fb25e1b9b97c0fee3f5ef9f47388e07b0da190be4351023fa4a664f283624bf755d76fe846183e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
9caefb2aad6828b28b24a8a6b4db3b61

SHA1
495ff1b1f69b6fe926d7647061d0037116c41151

SHA256
0dbb471fb8dabf50e6b4e1a9aaff014163ccbd26f2032937cdafc56e27303a52

SHA512
dd9994c4223973967b1ec50fbada1471d7a1768edd3c52ae43ee943916b1eb3f4b534e476800290ab09405db9a4ddae27619c3cffeab227de5f5b34672bba1f0

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
d58dd8ef2b127da33f843695e1833efe

SHA1
9553dec4d0ca0e0773a0e3b70fbab11c4a060c89

SHA256
7e8d060736558ac2b75167600f71c4da14b99a75e546f33892c96ec184eee04b

SHA512
8ea5ed24fca8ba72a0fae415ad796bbb6e932d9be9d14d4fd3a9df4347e61053180152ae9d59f78c03ed4a8251349a44b6477e75e6894f7867fbf7e09cd1ef22

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
c21360c5496c9be8af398bfc1b756673

SHA1
8e280f49ea69238a5ea2e6bbc70874933cf51699

SHA256
9f154151d83b4b295b4a0ae91ce1f302caae91d053e207a299a32d563e8b7ccd

SHA512
37f35f2fce1fc5cac3971ff7c04f0ce64312fa04c2bffa9b9d503cb2efc5e0a79ba0dff23518b47c13ce61b6c8ef51e0c7590f7082fab2535e0ed44c38529f46

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
0102e4855634c4cc6f1a0e8c18ab36b9

SHA1
53bf5cde46bc30a8dd6a11462f98cd48d9989f51

SHA256
4dc3cc37b29e7f246c3eb5d77450ed1d05c7f234b2e2c839403cd4d1a5aa2347

SHA512
bb8f82ca91293d9e9ac9e7246d822ab02f619fb48ca0667360866d1ba7debdf4d80ab251a84e59211bfb4cb238dfa0208ef94b86f3a5859a05d786dbafc3b1eb

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
2b851028d35b5819973138edc546874f

SHA1
552debf4b177b34d788929e980fa582cdc0a007d

SHA256
0119397f467ebf864de44802b0ec984ec897017c1b2f72f33d76f0fddf003de9

SHA512
9cfdbe457d4f9996a477fe86be2cbc9b79730d91f0733435efd6ddbb6573d7e056c18ababc3c53ad3b4b26d637f090518631502e782e2471c8071b99b5b5da6b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
82cd508b91228899fc5e830b4b944465

SHA1
20a58be77655eb257a4f3026e22f05e9a5746207

SHA256
4162531b86e82186c851450f1ba181047e4041cdaf63f15decc1a7cec2f7cc88

SHA512
d9c9eea9ffc436cba293e423adf137d39f2eb19bd74f5f2c2bb320086ded660a023bd1aad88d9a1f9e09b5da0b05255f7b735744597aadc055cffe6866c85c81

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
3000bf441c2f09c52ad78e5861dc2d5f

SHA1
0d3983ed0904b23d34adfe0fc7e9ca0af8873a73

SHA256
ef2a6ca581eeba513189db6b4e94cd132a36d0a0891280e7e9823e7967692d34

SHA512
3d75b5f4127c4dc97c8da3d78ae7a89079b5b7e8d87b732444acec01b7ec1b1c4fee0996d37cc6ebbdbc55dd8b2912b186b0444f6188d243d1a0288fac51268a

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
9f1d3ca8c47b1acad8f4ef77cb503568

SHA1
f2a3f9f44f14b624c1cc7ba914325974eb679a95

SHA256
ed7195c88a39c16dae114277c3b509a50c242fefdb3c7c5bfec32381d33b75e3

SHA512
10a451693b0458cbcf494a06125d3be70cda612d3af6f848c2ea411189f7623f58102de0cdbc16a8c42d6337981cd2dd576e0b9bafb4e6c38cd72cb8b990542c

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
7054b27ba8072f4d3fe70169a2925a9d

SHA1
d958adb018a7f9aa82ca679482e31bd276a39458

SHA256
9c3b04f8065b522248ed36b31643e30fdfd4e045feaba9432e0790b2a54551d9

SHA512
85fe30466747b67c53c0ba0ac305a0a449c2705ac3f294633dc058bbeb10d6bf57e32c103d5ef0fe8e1bfe6da40295e217d56cbf1e3d4117530dea443623eb6c

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
3e5564544216622041691ec68e5caa4b

SHA1
c52fdfbfc5b62ea597a8ffd0dc941cf4eb69e16e

SHA256
5066759cb7b000848182b272e39e41bcdcfc2f3c844d5603dfc8ca6c0806feb9

SHA512
3d9db92a94e8bb4017fd48b2c432eaa1e98248e6de967e077383b4246da9b3dbb95d79ad61620856e515d8942798733d072b01f6654fb1489ffdf1278ff7a4c2

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
02c09b91a7c2f2d4ae47123380eb1b8c

SHA1
00408977bbb0f71cefb1de092a8efb0714d58bb9

SHA256
f9f8d72c44d52a0163f4e023c3649e35aaad9978cb38bb663c6d6ea62ac82ddb

SHA512
48be866c77d1f981f14dabe0bb5761ceffa85609f4b7c142efac08861c44f8ecc8e358621fe48661f1a940e06ef22117ff4ecc027b36dcc49e21c3691f68e262

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
401203ed57a6e11d105cf5d54a69b133

SHA1
e1b8085f0bc4942846e42a5c2edb413cec236368

SHA256
f705ba628ea1a0ab7142f99fbc4f9a65bbcaa06941cacea914a231615dc496c3

SHA512
cda8a3c7671e271446ce7e1f45adcc0414fbae50e03926a8dab83e48a78b8e7684abf56fb470dde0cc0c9d85e1a069b43b4558dbf786be134feb272eee82c418

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
a4fc4b7e4b11016c618c7e1b4dcb48de

SHA1
f079d490755283379b5517c890dc6296c265dbef

SHA256
a46742929d8239190b969001978276d149291a941d5c442d1e5752b4d55f1fa1

SHA512
aae613b032968cbc705f8c435b434fbd026a75e4fd0c23ad92579ad3b0370c47d25b318dda3fd5f29101c1d38d831254921edccf54310cc5763aa8dee1a0ed1b

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
d7c53146eb8cb19685cc455df9e49773

SHA1
dced90886d5035582bd45734c7a7c7d3f5250df1

SHA256
2245134d01f8ee63710fc4c8778bdd638c70ec48eb1ca314c1683b6432c9175d

SHA512
8f9eb72e7fb4a7c5dee4266aaa1b5818bb6528cc675c62f68a79d527f46fc3644f762a2ee9f8731ea5064f0a49e3e67b09ec4d896046f967c2345eb4dffad19c

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
f146bb791ea12520130469e897c57db4

SHA1
2c59f9b8ac650cdf576f585de7f27b8d74240f20

SHA256
42650e93d34774eb9230f91a15e02a6d455a7598e92fd48181aba8374f89c3fb

SHA512
b6d0c5b3a17dbdb3334011ba68507be2e92a661543a35c0e1ba6f75d20932df7a64a98d26bedca4977da52d13c91213c3effee816703e5716265616e472a0be9

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
1410cfce7970a9912752d70086a579e1

SHA1
483b78bfd51dae96cf4e7555edc72cb4e11eb529

SHA256
0f7f39b928b3ef2e073ac2f70ef64664cd22004a9d8982df89db0802152846dd

SHA512
691cd54d4c01196bd24f2132960d4d0ecd195b3a54720d3f88faa950b6b34a82513d8f104bb8c7b41ca23d4a7d70a500285a6b0266e940e936ea3ed2c6685e0d

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
26ebbe1b84ffb0a412874338d14cabc4

SHA1
3098ee06331b5ec83c3ab4a5ea8d035a2b0bbede

SHA256
d889f7fdd779e547038971df256e351603eaa6307c6eac1c59fcc1dabccfa797

SHA512
1f5015dda1bfac3488ee20e6350b910d9151ca124af4a5c87ec3e2b6da4fbccd6c95c235a5a8d815a110948ddf78a59a6d8947932d4b0b81971ce952c0c20ade

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
2ad7cca705559ae93f241574cca0a4c9

SHA1
ed2f0982702018d16ed83eef65cec36cda9e58d4

SHA256
703dd36f80ca7e7474e3994b87db6222cf8276548e32f081c8b11a0d1b15c912

SHA512
351a0a2dccbe06f9b507d0b30299bb65a80dbcb473ea58974271dc1221ea425b73ffcd79795d751c0af71b3dc58f1a0b4016ad0ec335e167dc8622a2bb1f7ee9

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
d7d115efa0ad025a9c7ff1630ddfdb77

SHA1
4a25536c0688040da65b688cdf422e764f0a47dd

SHA256
62b9e7366a50a89208c0d45dcfb9fe360226409d02b4d6c7fc16c4dacf1dadc8

SHA512
29492b31df39746604bf09d6e18af6a7712ca245c28f241af989e8379654933a15ad4c8c47b73891a05c18fcf8d16a8425a56c08de2a796bd94174ffd64a790d

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
213d2661eb18d9dcee37a55d54f963fa

SHA1
ba1ab1be935378da970444f619cd3cc0e09deb53

SHA256
6e2768d745ca8b54850afeb0375f875fe1052ccce452ed550696b6ac5b7929c7

SHA512
a488b5278aae3d13af2c5a94d0d418fc9d3024475a055d25c2ce30cd75f823bf8aaa3da43367fd669073e97ef2066c3a804a52fce6ab965c6956766e648af533

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
439B

MD5
c05b619361d2cac0288befbdef519546

SHA1
634e507971e2bd2697df0cdbbe8772e6fbec276e

SHA256
1b2c817978649cad70d67be41215a663790d97707b7512cfc156b488438cbec8

SHA512
86308ab30375670ff5eb886d50e3b5be5f3b7d60e0de53458e0372c0c67cbfd1c58450acb201c7d21a5f351c2b0e796d1777dbaa1e2b83ef7f69a83dac26ba20

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
439B

MD5
783ec8ad8b0157f5692c5580d8178016

SHA1
925126d6966a109771bc628f3a420836411c247b

SHA256
322cda5f5fbb20b0d9f3fff6574abddc03f64761f8535ec67a6eb884f57a06a2

SHA512
99adf772f03406a739da398a1eb7e87ecf886dbcb6b3244c6ff3c0d3eedcb7ec3729d946f88373b8094a8f56134b53612cc02d12dd31fc206545f725fcbcb367

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
487B

MD5
e251c94fc14a772dbd695b0919d4f53a

SHA1
63c2eaa2aae3f097a6ad8952064d4764fe8295e0

SHA256
2e8a5e8288abdb773269792173899a3261c3a04c2a4d07c119988542d1978b49

SHA512
92222001d9e6f4bebf5abfc02f4a0b379b33c4f7dc4e9b27170e8b2d43f7c7e017632f893619d04f01eeaa48cfd79f77c7b910cc47d74d5b81f69ea83bd69a5d

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
56742a2a02614c94d3f16844b1f79706

SHA1
654dc03d285a234a3ba4bc0764a26eac831e1cf6

SHA256
cfe0a721813b346e1292960b89702042367db401663be92644729fa92948c5df

SHA512
11a9cf201130818faa343ad94bbf4989b9dffc0425af77753ea8c9caf31447e99bc7c045f73a1bb0231021f5107bc051719df578eeb7ff5c1f9a8407335d8d69

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
8c1fc04216351e8e5eb53ff55a60ef43

SHA1
4471a6a7a37d433fb7806651820fefb5e6d71b7f

SHA256
d5420d12fac5658e828bdd95a7138127520e46788f015dfcc07d8c4cff10e32a

SHA512
b2fb988c1a5c190a0f40779b8cbe8920f851c4913735b77dff23adc001a0db322792d73750b571eb923b2c8cf021687327b086fb8ffb8ef286a22ce8c2a78b37

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
99c55ddfca1eb376e7122f7c872e7965

SHA1
b59329999d15c0263eea8483c9f8859308d1be8f

SHA256
b2b2ce72def250a2574401a095fc4242d7f5f8822e109261597f7477cacc0315

SHA512
3f83fec9f21ab18687a466cdd9522bf69def7eb8779cb0203a53eaec2fdb30f7db8018debbb193dad41d244ecfd075241fbf1c91c2e67cf4c8d3c83db97a6e2e

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2117695429587d91e10f90d9ed7d5496

SHA1
24b46c9341548847c086a4a57840d3d9cf6cc33a

SHA256
41dbcad372507f1564e725cd77079010f2510acd357b86551690ab940136298e

SHA512
83014ac30038a0206a03bcd95028d12c8edf6a0fd7edf966ce0971593008f5c459d7f659d3f1c53069ccdba41aefcd25a2c96bd30c5be6be40c392354c34a1d6

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
24618314af3a34d5939c78fd2eed9650

SHA1
47e111e7b217a3fe6067e9856710eacc048b18e5

SHA256
4c36d44c3c01741af730a15bc8a6366a0dfb6a620a3ef92f6079ca876a8afec1

SHA512
04e64d335b432df8b3b7b90f1311f4f001a10e83bb008ebc716d5f804795d89005d0772839f5e11fd51c4f7d909fa9eaf47d8778f5445d50dbe4a02746351e3d

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
38608c2524d00ff39539852d7937e9f8

SHA1
c6129ebc8e5c26ed940a4871b94446d42e9c2455

SHA256
d40231d75222e407a4df9c357b131c4afb529763252b3e8b788dcfedc7eb1af4

SHA512
5d4f7cb87a030f693d61ed08f9f596aa0aa49fd8127dadb49498ef7f7961abce1ef06fe2f41aed5920a6e6f6013f3c1ae06cc5dcd510d3717769e1095a025159

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b54264fd8c44967ea0247bf7cd36ddd5

SHA1
b306450e25e1c9cb406e4b0ade44b88aac2efa95

SHA256
d9ace19534469fd916928fc69fac86768484413ff17eb39b082ec847c171e6ee

SHA512
d917d29d178a04c3cd2a4619185220dc240be94db7ea38e01acef65a4fa356475f80d959b3dbe3a42dcdae91b48316c67d78f8cc148207e2dbce12ab9b3d4ad6

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4084fb590e678905b731bd22ee534f0f

SHA1
3dcdd7c548e4ac7d5cbc544babb2d0d5cbdb8227

SHA256
f6ad74925328efb109e6ed4a379fdbbf5c2eb01ab565e669a45d0f516e67f221

SHA512
04d16c34854a4301df0f4925a47ecb5c8cc9e941b554cf0bc70b27656d6e52e0ae05f65dc47960ae9a2beb8f8fa8ff8bfe67f6d87055c90fefdd6089b3e07e45

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
889e12a548ee098cdc528d75ac93a5d0

SHA1
4a2cbb84074f2e21c71729d80119b82a2b34b5e4

SHA256
752910a7c2ea5a81b33772f7bd64131ea1f93c529ba84739570b723ff9f73a20

SHA512
2c36b0423adef06df24e64dd14965e67a0282cd56f6ca941e94a1959b2e60d82278ee208a0750d72b1070b206317df0387b56921655a021a68b57395dd433ec9

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e816f9da45bce91e4cef4419ccad7068

SHA1
ab5735728bd985f3fd1eab6cfe278db8faa4eee0

SHA256
d3086a5566903fb4360e86a83f7a4221b21cb441f4b1b03090e315c3a2bd5b14

SHA512
3878990ecaaf4229b5ddb19ec62e60c45e80b8a88aa808db9967f1eda8ac16f0da10f70ebdf0bb91e923fd56b1a5899ed7574e9010372d3abf8aaaf55a68416c

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
eda4fe868bdb1a2a0bbe4aa990e0d8f9

SHA1
7b98b9ea221f25d2c26f85b16d7be3cc8baae538

SHA256
f76a21f6223222657d148cc4a142f1990be8698d7b78e6504bf31bdb6a33cfcb

SHA512
23f525816dbe0f26cfd306497a625621f02d1e73674462548e290058b05b3492bb63712e98b5a81d100ddf5360d90b10979c1f0a14b3c9b94cb4d30b2973e826

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d2bd41c04e54566852c3294d09c50ad5

SHA1
2aa788fa4a0eb2cc300664f7fe685782a914e421

SHA256
3f5020c88c0c13832a1dd4aecbaebdee836a21a3604abe084911f430f5f9c760

SHA512
48a8a8d9a7de1ff0631f17ca382fbf0cc7f5412ef3074fdb3176be0d3ab22015775b099f8e875b1d481cf333d4eff2780ecc289b9d252db7eb4480548dbdf0ff

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
7556c1891679e42eb291e81e5ebb1b03

SHA1
427e03a2bcea3b88b4c1c793ce6ec2b96a2f9139

SHA256
d6c228554c9ab56c3137a4abd153cb0b0dd9a836d0b2e6e665014ef85f07d4b6

SHA512
5a9b681dd69ecb2c40c5f32c90b2e18defccf48e90339d05cee259858d09b03a528b86f7e280c17856548f094352956b0124c6973d6a7bd51f36c11ef139db71

Download Submit
/Users/run/2024-04-06_6229e75725065524688f77041d2fd304_adload_evilquest

Filesize
182KB

MD5
6c9ae063100f8ae91afdbc3dc456a78c

SHA1
ea01d25774c24040813568dd5506a61e2287e244

SHA256
cc159180caf92bd5db12bc4e13cd2efcb865d8df75f6342c5c28b97d3557c641

SHA512
1407df3b423df3939ccd99b58f41783e986dc73c45fc2d56e1fb3b912ca59f61a16553e964ad647ed5729e660367c0c206f2f6c29dd9b36f66970e67a3502f65

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
f478ea38ae61af78194cba65cb25f86f

SHA1
113de62bc115081c4df1a2fd6f3b94875787ce31

SHA256
783a4326d6ac17644a9cf0ec50ca0117f22bada7091898d0b622b03d1d6f02d2

SHA512
b393c86782b436ff9e3f1e0514f034887ef70e6fb97af0df51da4d0df52bd7c50f9f4c7bf65233292e6bdafdd8cb94e976cdfd1a7a3554c049a3c9fe733aff5d

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1261.xml

Filesize
162KB

MD5
461dcb8e6914ac8c3efadaa2ab3bfe82

SHA1
bfb82d565114a505c0dc45a7b88c64fe24c2a96f

SHA256
267aae1978c73f986ab32623d3edd0415e24888226d266bb42943765fbf12904

SHA512
b6e500d7c269c1fa7fe796ded05d3489d2c773f1e02ddc87b99a777cb89f5837b527bfcf4a1ec01a155ed8c07bc4fe9b8ff8c7d3672bc9ee89be09c71bac13d2

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/var/root/Library/LaunchAgents/com.apple.afsvcpd.plist

Filesize
429B

MD5
b29145cf94cd1ef0d81552c333c3603a

SHA1
4095a7b7b982b8875a6256919b7d80c50b0a2799

SHA256
2cac13ffabc18f7010fffce9f31aaacc06e0c5ae898c3faa79d747567ce1e2fc

SHA512
fd0ccb56cb0c5084950ad4d04363ae9919a0bfa76c45554df8a7fe0eb0f8a7ed2525af3b4f64982eedac0f9aaec28b7985b4ce5ec80434fc3cf426cb96b1def0

Download Submit
/var/root/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
cdcb14548ceb02ed389e50926daf67da

SHA1
0dd7591067cb8a88a6d1db9428913ad15825f2be

SHA256
66f44b7390c38d47f654aa0be7c237d8422483f0b8b590662ec3fc343a311e24

SHA512
88dabebc6fba91f21cf4b58a7b6d3420915673dd91293e5af6b66fb93c6bbac5a7394bcc2669056c07d8d8c994c543ac9e00f23fea67812ad593a71fb51c7b88

Download Submit