evilquest | 5c0634526d992850dcbbca52b23d0f4463167ce04ddfbf00507d5edba7cade53

Analysis

max time kernel
150s
max time network
146s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
07-04-2024 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-07_1b2f6580e31daaaa523fdb2c213522d1_adload_evilquest
Size

168KB
MD5

1b2f6580e31daaaa523fdb2c213522d1
SHA1

8c9c90f256f74caad23395b5bd696840df5b30cb
SHA256

5c0634526d992850dcbbca52b23d0f4463167ce04ddfbf00507d5edba7cade53
SHA512

201c36ccdcd33e017078965301c7a1712a9389fa368eb7207d0a19801718721e3a9ffa29cae7862d010bda1b72f19676f1e2a2f5f993e433f9c6584790189bcd
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9SI0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 16 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008af92-1.dat	family_evilquest
behavioral1/files/0x000000030008af90-0.dat	family_evilquest
behavioral1/files/0x000000030008af92-12.dat	family_evilquest
behavioral1/files/0x000000030008af92-19.dat	family_evilquest
behavioral1/files/0x000000030008af92-27.dat	family_evilquest
behavioral1/files/0x000000030008af92-32.dat	family_evilquest
behavioral1/files/0x000000030008af92-37.dat	family_evilquest
behavioral1/files/0x000000030008af92-42.dat	family_evilquest
behavioral1/files/0x000000030008af92-47.dat	family_evilquest
behavioral1/files/0x000000030008af92-52.dat	family_evilquest
behavioral1/files/0x000000030008af92-57.dat	family_evilquest
behavioral1/files/0x000000030008af92-62.dat	family_evilquest
behavioral1/files/0x000000030008af92-67.dat	family_evilquest
behavioral1/files/0x000000030008af92-72.dat	family_evilquest
behavioral1/files/0x000000030008af92-77.dat	family_evilquest
behavioral1/files/0x000000030008af92-82.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 10 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""

Launchctl 1 TTPs 20 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:534

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:534

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-07_1b2f6580e31daaaa523fdb2c213522d1_adload_evilquest\""
1⤵
PID:536

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-07_1b2f6580e31daaaa523fdb2c213522d1_adload_evilquest\""
1⤵
PID:536

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-04-07_1b2f6580e31daaaa523fdb2c213522d1_adload_evilquest
1⤵
PID:536
- /bin/zsh
  /bin/zsh -c /Users/run/2024-04-07_1b2f6580e31daaaa523fdb2c213522d1_adload_evilquest
  2⤵
  PID:537
- /Users/run/2024-04-07_1b2f6580e31daaaa523fdb2c213522d1_adload_evilquest
  /Users/run/2024-04-07_1b2f6580e31daaaa523fdb2c213522d1_adload_evilquest
  2⤵
  PID:537

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:538

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:538

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:538

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:542

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:542

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:544

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:544

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:545

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:545

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:546

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:547

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:548

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:548

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:549

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:549

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:549

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:550

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:550

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:551

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:551

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:551

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:552

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:552

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:552

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:553

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:553

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:553

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:554

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:554

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:554

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:556

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:556

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:556

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:557

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:557

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:557

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:558

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:558

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:558

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:559

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:559

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:559

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:560

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:560

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:560

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:561

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater4B941C11/OneDrive.app
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:564

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:591

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:593

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:593

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:592

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:594

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:594

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:595

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:597

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:600

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:602

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:603

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:605

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:606

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:606

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:607

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:607

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:607

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:615

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:616

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:616

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:617

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:617

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:618

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:619

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:619

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:620

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:620

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:623

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:623

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:624

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:624

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:625

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:626

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:626

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:627

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:627

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:628

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:628

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:629

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:629

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:630

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:630

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:631

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:631

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:632

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:632

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:633

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:633

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:634

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:634

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:642

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:642

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:643

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:643

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:643

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:645

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:645

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:646

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:646

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:646

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:647

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:647

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:649

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:649

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:650

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:650

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:650

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:651

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:651

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:652

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:652

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
14863d80c8f9aa7dae25db9e417a4385

SHA1
7eae269496e66a7ba0bc4829a48880b6a97619c9

SHA256
3e0a3d29ce5e720db24442169018dfeeee5e117c8894209c4b92817232ec315a

SHA512
b727c0b01866f4e46f6c02aba96c54b9c9a24a546374bd6f303254fc27a6cafe8366ef0ccbb7065594f32ba435a463a96a91199e5fd28afd3dff485ccd5dfe17

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
b2da8989a25f87d3b3867b54364e2821

SHA1
a7372e6d91b8909f30ad7d9b4276159d3ff066b0

SHA256
0a95d7288f92eb2a0b8dd9ce6c14c5959d5539d3d30ac78a45f68db274c4f9e8

SHA512
94d04f5380ac6dc4e02ddaddb9e0ab27f812d90873b455b977332e820c254a2792e3a3333ff4ca095cd1f95bfaab4681b56894756fcab6a486f9bc7a277d6b28

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
8a4890913433a355152624fb2b8d981c

SHA1
1eca1b1060896131dc156fa0f3e3a51666f7d997

SHA256
05c236083be1b128614694b40fe83c02e3b435b901c40019dd3f7dd572328c66

SHA512
953f43389380c1eb3085aaec682877722c3cc0b0e94da0736089c1b68d04a75b6a93574beafa8e29cb97460522ea0496f44145e461a2d37c96a45d01744d4c4d

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
0817f99bf8a0e91e7f0e6e40269d3851

SHA1
3877755d173eb0285f88c6434f96c2bdb0fbd837

SHA256
4aa7fa1c985d4a08a8a94767b8b905b89053892c183bd13149037e9afe7eade5

SHA512
d674ed2fee62bf8261639e7482865b1a8b3c94f40378940e366e3533f21692c4f3c4d7af203803aabf46430625fff578d9b55e1f4978a9f65b22f5c6dfc4b641

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
8cf4d5364d7554b324bd8032f36a7cb5

SHA1
5a197c282040a658d09ba902f299e6e158909f2e

SHA256
b14add3ab4a7effa6bd800eeef1a5ef6f9719ff5bf619d9870893489b8577bd3

SHA512
ede392cc1d495b5548c795d26659dbe1a0e99350c60dd27d1ffe19a261ce4632ec745f9b3c6443a41f31acc33c1a8b4763df90e7647b2abddc32a97cffe237f3

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
19d1a150890dec0e89e13df5e8218254

SHA1
7d5f5053b20248b6a05e61c7aa52927d7d8c40b6

SHA256
0e9d9eb4bfd2a3a0e30d6b02ce24793b647144a65585639242a23cdc13a1c5fd

SHA512
60de3c5d7caf9bdb707c207eb899d6ba8ad1d8cf7839c0e1c013d94b4e62a1a895d95052a1411643a18b438e836c337f76362b15449d70dffc99b811c9661bc9

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
cc5054c03ff7b6a158a515cbf0b24b28

SHA1
7383c18897f71fcc86386e80c65f3c4556e729cc

SHA256
5b2104cdf5e6caccd7b116531684d7ba11f3162f71411c797881d10eaddbc826

SHA512
aa806a70389d6e0402d43211b83caa1f183199c45fcb9abe5e3a33895e76909b6ccfe76bac536bf7596ffdd95775a42fe6846f6961b0a02eec83ab111b0b38e8

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
66c6e97fbedb38c9d9001f940738ea0f

SHA1
65786d5d871126cf5a65a47e4f6a581fda0c79da

SHA256
dc1e5364f688e95fd32f61de88d8455269df205fb22cc0fa0b5cdef8fd874b11

SHA512
bc9c0f231fa5464281da937151b5f32ab0648d4448ca41cd60d12163ad00072666af5438012270912600e125189adcea304faa77ebdfba10862d5eddd801172a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
d90f04700c15653198a9f6409c83d4fc

SHA1
fc079a2fcf7fee7be1ff23e99d0ab1093d5cadac

SHA256
8507d81f6948dbdfc9af97cfd674ff0803f72f63d3ad6d0d54f372dfcddfc772

SHA512
50210b35387da174adcefe35669a69337de8e79956f5a04de0e985122ea03c49d53c1292250ae63d8c9391d7e552f40e606f5818f2473d198967b396afbdbf6d

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
2a776ad5cc3ccfc6882eea1094a55005

SHA1
1ecd82af433cfb2157be7e1215c3d0e697022bc4

SHA256
88ee8a1c159346f3109ead8543f58c117e0cbf7d3de354054b0bfbf06765dfca

SHA512
f944f6563f8fcea19c1164794391a0061cc1b9b1afdd44e6ca9a823231c195f01c369d9e3a5a27623d03ae6cdc5cb432e4dd5fb6ca912f010ed77376e665d606

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
4fa418a61debf690b96e070c4bcdae5b

SHA1
861f31ceb1ccde0e559af4aa66f5407d5b52b3a0

SHA256
8518693dd0eb439f3478fe903cc1a869822201ead2039c6e382344bb6a164492

SHA512
50ab3d91c84598d9cf0f418220f7649e6a0bfb2faa263b8f37681687eb8810d0f28e9c0e52df8794d4302517cc8441342d82ee9e2449541e35dd51b2813836e6

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
bd06e9d7c45128a69062b561d4d3f65a

SHA1
31b51b3cf9a2055a7e31199801be30cf1fdd4882

SHA256
26ea5deb6c7cfd9810a54c205849239cd60cfedc8b854ca5d2ac5f126f615c62

SHA512
9a9924c3460d1b3ee37ec6663de83d5e4b3fab1388676b0da010e6ebe02af69f0b058a8103bc85da2bdeec1dc4146c6f17c9eefa00912e2e90e7486328b89f8e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
8a8d6c013b30d1e2f5c9e2f06b2f8f4c

SHA1
898e9574367c2696db36927baf3c29d6b1f47d2d

SHA256
a623bd55797a5028178ed7e73b814bf514c2f2cfc2133a69fdcf90e63692338d

SHA512
2b29631135ce6748b4620f9c86448804584833efc36e121db4421a25f9cf0897255272bc313a97c599f37df1d4d40f6864a95267712d470c04c2921e70360b3d

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
ea0f76062737e8e5099ba40e3e4d2d32

SHA1
4b043c9f8186e0d4143db334502a8e957c197073

SHA256
6a44ebd36d059d8dda1c1e6306ef9569f4283803d4c6fd8eaed07e37cea489e9

SHA512
d05a4a56dd2d4ede959692cb0747195b5b413038c07ee4954f52866c00640a48b1ced1024773f41ad5b57a52901e11aa8a569f110a9cedecb3ac33bb63034a98

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
355B

MD5
a6ef4856e99c9d8e1d9bb762c5a8503a

SHA1
25d5405ad91791b716ae5a56b37aa2b393854967

SHA256
232441aa129d4f21999860b8bf31db4b8617df9f7d32ef5f25a383edff82d9fa

SHA512
582fa1ea60766a5a4e99b295a8ed98c94f6bab45e42b7e8db61e9ad645f531891082cd457bfd11d660195af86f02c4ed93589e6e6daded683cff2d8319bbc489

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
8c89d042d88d93a36e9d040aff3a30e6

SHA1
2419c56f71dccfbd7bc27ae6f89dcd6d7de74ffa

SHA256
8de94a713dca05437f9f00fa88c9be266eba30a6bf5b9aa3c5c3c8db4ae4814f

SHA512
d958c7acfac16badaa47fff9f0d6878b1c964e240d6a395ea583b175243afa76a845a52ff9ccad01c2336762d2b79d6a4e00372fa51bac03b339907b20dc910d

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
0eb494dbe59bd966e647f036472b89d3

SHA1
382b5df27c9e58b06722778898f6caa0d297f7de

SHA256
e27c8912cb2262cc4c2a1405b839bf8f760d802a9aa32ce67488fedc7002ee0d

SHA512
3731b49f275e2c4f1970ba81ba477c2504021013b6c3c1ef43c40c356afb5f7fe868c19270ac664ba22fa81b6a1024bd5b53bcdf9b6822f98ec4bb159cd0cc89

Download Submit
/Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist

Filesize
430B

MD5
3d269391b44f568c96f9f5a420609082

SHA1
e2d49405da7ba6f883b366f71b6905b6ab556cae

SHA256
261e6af4aec0840afe0b4c75c21353d7bc8d69ffb1d26db364f5475962381a12

SHA512
81ae24faac0d2973a90b7ec7415273f95789fbbdeae164df6ffab10bfdfc4896d6ecf4d9b09ca13b2a151a385c59f48594d7b3d0df3b49e3bbc056f15908432c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3085c64b982fb7ea76bc4f52424ee622

SHA1
7790c0c58c0c9a9114a50ccb7f80c4c4f82f35fb

SHA256
d9ae14333565a610f508545007c7fec6131b004fb58444b1ce69e638363c1c3f

SHA512
9d13052cccd2b824d956f0781edc707307dabb1a4f7abfc328c6c996167cd8193685c455c4924fba0b5fa4d925b426a56e0637b33f2c3e0bb913d731fb860d6d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1d73a4c5d8d126b8876fee34cdb22272

SHA1
12b4b3418ae1cd6a9f5564992c1b72989378698d

SHA256
a0f27b8f4da0ffb8846f9f848274fe48c5425fac4b1c5c366ce2808bad55d36c

SHA512
c083b3eefdf96b574f53511eaa3f7c2f229d4a82757c1baffcb062c2d5b2823456e499c03df8842b07eb245f787e6f29a33ee200839a92851d35a53dc6112517

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
72726110708d25d20ee640ae28cdfa8c

SHA1
8a1c8db3a2119f823aa2463364f9643fc1f2dbfc

SHA256
7166eaf91094c55c51957bda74a5af1e78680143c32551431762cba354a82519

SHA512
0c6d7d4835014220c34c107b5a555d715b2a90078f2f569ce03b134756ed1937d21ed562080b79d3a796bfa64734d4c100f356cb50118161bf5b8e65cdbd4d89

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
bd15bbe4d2a3a7db921e3b8f240b5576

SHA1
189558ad24c2fe198a3678918662febf8c031f5c

SHA256
282b3bb1093c1675ad94726fbfc4fb0ee5d129d061fff2ffce13fc204691fa8e

SHA512
780a3eb7e29cdd649a939540acd5a7de41202358fded5e0b8a2c41d1dcbe649e6167c4c59a85c8c1e30183ce81ea9d463f47f09583b518cd2250a8c366163fdd

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
febc91947e12f1b83c500edcb32178af

SHA1
87448665f82de800588eae31c545e2a6c462df0a

SHA256
b401657b4aea3cc376e51e37bb79db59fb3f18f0ac67b65e37165c5e74df5ece

SHA512
7d59d53c9320604d523f7399bdde88bcfc789d9b025bcf41d7f76a9ea00e6522c448397f1f5b899767f5de3477063af612fa59b202bab325ba9d92bf75ad5671

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b5221d125b7bd1a8313e05be6c9ca699

SHA1
eeabeea992f7741237ea62736c5c9284032bf716

SHA256
2fe7320d5ad6f3f7a8f85379c8905297f3efe52225c58f7807d476ded3af483d

SHA512
97f42c521e292680bbd108218bce2bbfe6f2625c11ab0e8eb27d565aa3d4f90b1df4b2ed9a41616d18565b08f7d692fe1d5e392017734123640784d5b9ef874a

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
37dcbb8561acc6c03e28af28bb80804c

SHA1
5c011999ece2c6bc01a6e21eec3e800c7610c9dd

SHA256
70e390fef48d064818e437ba314be106123b44dc036be409eba65ff7ee646297

SHA512
294b369a27ba01441e2c113f2cb5ab2fb2b75eacbc2397b3c8d53c8a9a9dde7556889be22931bc7b8e87dcc032a9aec3176c305a51683be9d745b6ce33ef3c2b

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d11979321c90b721aa76328aa3f76ad0

SHA1
183555fdc09f068a2c034db2ff99526987c6891e

SHA256
ed25851fe39912e2317f183da0603f27b84a84742fa6cab6ac426411a558d0c6

SHA512
dc1db52298e0853c5b44ce26ef2050ec700dc9d4da59df90fdca6ea3b3fb127e7702619e0c392c7568f5067a5921c0d9b64ea9868b1176eeaa06a8209272fa5d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
16d9bc18bf19f83f94eb9989a2db3540

SHA1
175433e52966616b3426cbc5629d673d357b9579

SHA256
be17f76538b23100215d7bf3ad95eedfc7b3808f95d96b4f08feae977ffd23e3

SHA512
b183d39fa1f5930718edbb348bd1effccbba1af87bede3458ba4877941007bad1f9ba3202d291d6b4110d57607eb5a552f7ac0b3179b4690c3654afbeaa2712a

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
34080647abcaab817bb689bca33989fd

SHA1
feb96cddd2518367ed0f5cfa40848a7ee7365bfb

SHA256
d8e9a123bf3c6741be98121b7bbfd1338a85957bcf64614793e5e49419ad31bd

SHA512
52c47657be60f9a4952b81aa7e2df5b01c31d7781400a179c844c1fcb226a81b45c763197f54334bcb990a4b7df9fb268fd8788077a59dc7a76bae93e178798a

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
7d9926278dbdcdf7f94eae7b389efce2

SHA1
e580be4db7e710ba6a576a896454dea632b3f13e

SHA256
edd1e6f7659ab62f9c7a513d0b03d880c2e0b3468fef34b5b326de9658527c3f

SHA512
86812114bff36e46c6e1f74228f8bfde932b1f4a7fa42c4b9a8390bb240035f9a8136d76e0f802b4c0a5876904d3a198c9fdd6491ea07ac6f121c2a1cd223b96

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b83baf75777a4328dd93d59a80923276

SHA1
9ffb877f05159b355c0e87a62b78d847332f5832

SHA256
19bfce2f115419049198902321e01cca79080d775fb41ba75ecd1db7eb52e650

SHA512
3dc677368c95366065a3b34413293342b725435a8422342a7b9d04a93d591c21411d2d3a0894e5e763c3f9dd114c45586c73e2aac4a1e25486d220a3c96b9b28

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e88a80b7b9c5e89c14819929b37c3f29

SHA1
d04f4123821e374c94dca801aab33d99383f0807

SHA256
405455c60a4188615def57299a041b1cd545deb9f6d3ac451aab36aec814950e

SHA512
807ac5ddd9827ee3ae6130496003dd9c4422261a626b124705937d5a868851125b7c0011c069db3e9f07d466feb043c274873fb494f68c53efe36d272cd19415

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
de3bb4c66a42b3f19c4d9282f4a95df6

SHA1
8d2c60cc73a44926bb25e25a65e89f458c1fb9a9

SHA256
d4fb6d85838c03cc5688482fb883f42782000d8ca6f97db2728a09180145f28f

SHA512
6841f4e047dc92860a1b223488220651bc7c9c8d313238df24b5cbfab7fb16e17935a30476759fcfae04d78ee2d382dba2d68fa7d1308a0462a71deda27dd53d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d31e468c0d00ef95c0fd62791a8206a5

SHA1
7f1e662aad746cd6d10dcd74672bb308c243d2f2

SHA256
8ad4354b3de47a7c730972287321206d3551c7ba96b43696c08fd709037b5e88

SHA512
7fb632c2103373a562355f42cd100afc17531823ea8462ef193decbd31a9d4d33bd28455ce4dda4d6a8d4383e01f4d08f221b1168358d62917ddd8a0d92a37cc

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1261.xml

Filesize
162KB

MD5
461dcb8e6914ac8c3efadaa2ab3bfe82

SHA1
bfb82d565114a505c0dc45a7b88c64fe24c2a96f

SHA256
267aae1978c73f986ab32623d3edd0415e24888226d266bb42943765fbf12904

SHA512
b6e500d7c269c1fa7fe796ded05d3489d2c773f1e02ddc87b99a777cb89f5837b527bfcf4a1ec01a155ed8c07bc4fe9b8ff8c7d3672bc9ee89be09c71bac13d2

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit