evilquest | 5aa8ecc045b4740baa1df5af369789bdfb5fe5ad6fdae960defe63413ba9ebd5

Analysis

max time kernel
150s
max time network
145s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
07-04-2024 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-07_7bf238fdf30f95de34b929417e3c1340_adload_evilquest
Size

389KB
MD5

7bf238fdf30f95de34b929417e3c1340
SHA1

f4f2e6f6daaa75d2811b2fcb346c59e7167604e5
SHA256

5aa8ecc045b4740baa1df5af369789bdfb5fe5ad6fdae960defe63413ba9ebd5
SHA512

19b0d02a95b170fca50dab2942114a443db8aff8e1953362f234a04fa7db96ece3d9982b75a68a17b43c293cf0954c55bc3e48bb7ecbabc164f7e05fbc9ea248
SSDEEP

6144:5SeOQdaZNxtk8cqhSxvHY9unjCIQwa6QXbYRPuCnfL08Y/ok5XM7mM6QS7MkBh:5LOQdaDxq8cqavHYEWIDaJXcl/nfg801

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 14 IoCs

resource	yara_rule
behavioral1/files/0x000000030008b12d-1.dat	family_evilquest
behavioral1/files/0x000000030008b12d-3.dat	family_evilquest
behavioral1/files/0x000000030008b12d-15.dat	family_evilquest
behavioral1/files/0x000000030008b12d-23.dat	family_evilquest
behavioral1/files/0x000000030008b12d-30.dat	family_evilquest
behavioral1/files/0x000000030008b12d-37.dat	family_evilquest
behavioral1/files/0x000000030008b12d-45.dat	family_evilquest
behavioral1/files/0x000000030008b12d-51.dat	family_evilquest
behavioral1/files/0x000000030008b12d-58.dat	family_evilquest
behavioral1/files/0x000000030008b14d-66.dat	family_evilquest
behavioral1/files/0x000000030008b12d-78.dat	family_evilquest
behavioral1/files/0x000000030008b12d-85.dat	family_evilquest
behavioral1/files/0x000000030008b12d-92.dat	family_evilquest
behavioral1/files/0x000000030008b12d-99.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 56 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found

Launchctl 1 TTPs 64 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:570

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:570

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-07_7bf238fdf30f95de34b929417e3c1340_adload_evilquest\""
1⤵
PID:571

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-07_7bf238fdf30f95de34b929417e3c1340_adload_evilquest\""
1⤵
PID:571

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-04-07_7bf238fdf30f95de34b929417e3c1340_adload_evilquest
1⤵
PID:571
- /bin/zsh
  /bin/zsh -c /Users/run/2024-04-07_7bf238fdf30f95de34b929417e3c1340_adload_evilquest
  2⤵
  PID:572
- /Users/run/2024-04-07_7bf238fdf30f95de34b929417e3c1340_adload_evilquest
  /Users/run/2024-04-07_7bf238fdf30f95de34b929417e3c1340_adload_evilquest
  2⤵
  PID:572

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:573

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:573

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:577

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:577

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:578

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:578

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:578

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:579

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:579

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:580

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:580

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:580

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:581

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:581
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:584

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:582

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:582

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:582

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:583

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:583

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:583

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:585

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:585

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:585

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:598

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater2481EFE7/OneDrive.app
1⤵
PID:599

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:609

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.findmydeviced
1⤵
PID:611

/usr/libexec/findmydeviced
/usr/libexec/findmydeviced
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:614

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:614
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:615

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:616

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:616

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:625

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:627

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:628

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:629

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:632

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:632
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:633

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:634

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:634

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:636

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:637

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:637

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:641

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:641

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:648

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:651

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:651

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:653

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:653

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:654

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:656

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:656
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:657

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:658

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:658

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:658

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:659

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:659

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:659

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:660

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:660

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:660

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:661

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:661

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:661

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:662

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:662

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:662

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:663

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:663

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:663

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:664

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:664

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:664

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:665

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:666

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:666

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:668

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:668
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:669

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:670

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:670

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:670

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:671

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:671

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:671

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:672

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:672

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:672

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:673

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:673

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:673

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:674

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:674

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:674

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:675

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:675

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:675

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:676

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:676

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:676

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:677

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:677

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:677

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:678

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:678

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:678

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:679

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:679
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:680

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:681

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:681

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:681

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:684

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:684

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:684

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:685

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:685

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:685

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:686

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:686

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:686

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:687

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:687

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:687

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:688

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:688
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:689

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:690

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:690

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:690

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:691

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:691

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:691

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:692

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:692

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:692

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:693

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:693

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:693

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:694

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:694

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:694

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:695

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:695
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:696

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:697

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:697

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:697

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:698

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:701

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:701

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:702

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:702
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:703

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:704

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:704

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:704

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:705

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:705

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:705

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:706

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:706

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:706

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:707

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:707

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:707

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:708

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:708

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:708

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:711

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:711
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:712

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:713

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:713

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:713

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:714

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:714

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:714

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:715

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:715

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:715

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:716

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:716

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:716

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:717

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:717

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:717

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:718

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:718

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:718

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:719

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:719

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:719

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:720

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:720

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:720

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:721

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:721

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:721

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:722

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:723

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:723
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:724

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:725

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:725

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:725

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:726

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:728

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:728
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:729

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:730

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:730

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:730

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:731

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:731

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:731

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:732

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:732

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:732

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:733

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:733

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:733

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:734

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:734

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:734

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:735

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:735

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:735

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:736

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:736

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:736

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:737

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:737

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:739

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:739
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:740

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:741

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:741

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:741

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:742

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:746

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:746
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:747

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:748

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:748

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:748

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:749

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:749

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:749

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:750

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:750

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:750

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:751

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:751

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:751

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:752

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:752

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:752

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:753

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:753
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:754

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:755

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:755

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:755

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
505b6a68050ac302a878d3c38096dab4

SHA1
246fde917f6dafb69a16d3e2185b4b77be911aa7

SHA256
6b1330acdbbf4d6b8d583f57f2450aa97b526011498391beaff123880f8d0cba

SHA512
3c0d737ae54e6e531f96a3cae7c7acd2f1d33649aa55a5a0a1f2c4a22e6747fd2d18b97080f9e6001fe48ae01249b9fb5b9bf241535a3503a6e39e1cd75cabd9

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
bb133fd09c4f0c89a8fd5b8f506519c0

SHA1
f6daff9de1311a48aeeba73aabe950260ecc4073

SHA256
6b500dcd578eea52eefafbff93f23a33ac745e346a8649bc2a4639787aedb859

SHA512
de362926ffe1869e5d5c3e61d0604f50856006c69d0e8b27684743fffd1540b8f72827dcfdf3ef9cffd59b00c19440ac8505ab383e0be3240742cfbf7ab22b13

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
45376c1f68e7fb48168a9480d206e7c9

SHA1
ae1fcd5ed1d4aa57b688d19400634e9ee7be2f17

SHA256
7a6de46e96451482a4ab118ebab20488663acf7c663179eb9b7565e7891c7a2a

SHA512
67b4a41b68200cc8bac84e5780b765b932ac6cfc02080e07eafbc056c381c8305151f59c0fc42dc92b8336970768dd04c1cc6e6bc68068e8c02ada2d2bbe1352

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
de8987a15d10064484f33999473e7f1c

SHA1
a0f96adbe0c8bedf1072e6d50562d1d8ac678f50

SHA256
ba83d46fa2ebb0bb82001d9287a17bcd6308b69ab97fd0dab5a673c789c63ba2

SHA512
d9849e67a2e05f358d3bd7338550e0a8896959555c37c5459e48df547832e1aa139e55a79c5f92d0a2afe2fd37dad010bb92dc8204f3355a732eb8f285240261

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
c70ec94268511e7a3f7e46920f6c7004

SHA1
61dc0514c15ed94967439ef833d35798b6eb1911

SHA256
7a9de285635c7cef6e36e8ce1ccd73faa1946e4b2db900cce5c202ae1ad79dc2

SHA512
b3a63fa030ae0971167f014e23ad08e7754da908aa33bebea0b10d2314d6981a3552144eeb6564ea455ca75432af65dddec221940c6aa063b1234d950fb235cd

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
3869b9ffd19e4016cce5e9d47918a22f

SHA1
8b722cceba111a0bc53c90b50bef2265ee5f2dd4

SHA256
2d5854a34bc86fcfe65622510caaef0c370d0a21702d0faf683339239df98f36

SHA512
23129222694be7763e486066514e4e8010cca80a0c7ed3c13da7f5eff63ce388c585dcc10c5e4b1da9d7190344c1b19d33d4ac6338b8b84a60d510156d397970

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
2c6727234cd33a6a9abb708f827e884f

SHA1
2c072d579543b511580cd46e0ce25a2fd39520ac

SHA256
39051b4865315fc5fe2ec91590518ec0213e4bddb50fa17e651681efa39e81a9

SHA512
e513812f0668b6e0b1169b740434aaa2a3fd9027fa6bd7205e33077d5dfd58cc16ee0d0ed832b4c2272804d9b958f458085be120bd9812ce86e57b5a1b7420e6

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
f068d11c9ed4a5a66c774e9eadbde53c

SHA1
8364d46eb5acd7ee84ce86463b1f44f2154f0600

SHA256
11f09d91da9276945dc919018c89df5c20f65dc606fc93466a81ff2cfd0b75ad

SHA512
18f57ece22ffc58e8fdf4fc3bb6496d8829c49788dd0b76558eb650703dc511d72fc5a1375a5d97b26b5cfb19be251d3a1cfc72399953d11102fdd23c95a3b1b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
6e8a645fe5a7f7b090149d860fbeda55

SHA1
84087e67ec53f19113124e06fb8089f5a10dbd29

SHA256
5bd4251a5fea5a1c8ebb064dbe7b8e08434e317d1b8fda62b27b82ce0fd80dda

SHA512
03a694a412f2553273fb225152e123caf2a0a14a1354d8f9b51bf49998ba694c146b783b170b3262aad1f601d7973d7123c1dda712dca40a5becbad7de2e2624

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
82622ea34b48b381ab94b548ca5106c9

SHA1
9b53bf748b3ce98abcdd98b1e13e747f9c9cf985

SHA256
b6998368256d2489838bfe35c9060cca01f7e793c5158a86503da5e3b59a5339

SHA512
f88901400e10278944e39654b0bacf25f79c99ad28f7a6acc4f2d51a2b038017f37e7ec60cc879dd664d66b23b7f189a6e92d88c2f83654936e84eeae7869008

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
7340ef7b85f8923dd14e9cf6c3873508

SHA1
3b3bfc83416ec9c055473aa80f51146c936d1e60

SHA256
bd7b4ee57d07eb906d5899f47a75bca57f1b64590fbdfce464360fa0b7cd10b1

SHA512
f2c556ac9f5516580b1da3278cc5b941c10d270f0898121a9c153aa452f93e6fcb21dc32afb18c9d34e7c25523f35aa33b0d338b071544f3e47bd61b9c45bc29

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
d170218cb27302c48d6a2d4def0fe875

SHA1
4f1c3ccbfe8bc9e6ed94c5749a49d33105640f54

SHA256
572fd1859fe1a1be64f05017e9d0d12e4c9bea3ec9a0b0fdb3df2c8451dd3bb7

SHA512
f6a68d0a247bf96d80d8075c1a0dd0c3d0b51b69f0f91aa2a9b3836072ac1210759530784785215d6c279bef6781be6d225f12d2230f55bdfe3871c4e6560fcd

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
0602a419545c04614e3269ce8f78de3c

SHA1
792818da95ec924227defe1258ca1affc4c190c2

SHA256
9b3f64d7bd06c6a3ff5cb6ff5c6ee8d7f15f637b7ee350a61d9347030a749c15

SHA512
ad3640b2c0e3ef7119173e91776c90b7f42f66ec55a612ba4a6baa47b07e798c01773c2ab64cb4ebfa321a94051c4d6c338da893701cade67e981e94a5c22c9b

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
3241dbdc0353dfd7d6120b6ff901bf45

SHA1
1e767380c91881da9e1d4177db0f45d30db58044

SHA256
e85a80cbb4aac68d76241d706c818ccbcccceb8e55c508af782a20b47f345893

SHA512
78a93df6169b878d68aceda772730a10757e95338516d53281d2abce69282828eaa3d4d636c8a0cd4b5048967dc2ad4382304f807903a1773dfcee58b56f701b

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
a99422db0de9a7a2d354efc35ae70ace

SHA1
968c5c69b6ceac3df97f595b7e1f4a1219d1fbde

SHA256
2cd4171e0ed2f2edce32d520625757c11749dbaee090d871b79a5d78003c2ccf

SHA512
6d7e075aba27a14644249c611d97b2076ebbf67fd0fcc9594fd2ba78cb024add78ec702ff2715b12abdf806dd04c28d473b0288db679110e3cc815fa670527ac

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
51ca9dc6875f05344569b1bf63fc76df

SHA1
7683e253e73adfb1eef24e4b43f6c1eea93a4915

SHA256
c8861cab6ce816b2bc75cdd2102ab9ccdd22a7baef8982110f11663ab5f4f963

SHA512
73ffa6ad05f97feb12cc843458f3fbb0f90d36e6088776bf739abb3139a2f916f1c070bc1a6ef3df65cb21e02ba69f682bf09cc12cae721946d41acdaa0878e4

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
946876e1a34dff463033763b9f4ea49f

SHA1
30376926553813adb05cc4278a66d1543c043203

SHA256
ae8503f2f400782ba29285da5a3cea1a50d6214f41b61e14e6c14382e738837e

SHA512
afee02f2730c85491a4b8393715184365d3bc5072747193f3c9a288aa34a4084283e33a46d9da7e1dc02340bebe3962e2ad7bc28bf198b927517026d28fdc36b

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
4b9cafc882ddd39c92227e8302329a11

SHA1
1f6d9c4045c33e698b1dfdf260d64e99d8e57ca3

SHA256
fc7f819b02080ede7fda19b3cab6d2db2ca4e828635bf197e46e02630f85d114

SHA512
010a4bad80ad6dd936bf41ab074d653a35187cb6dd072e9625923d0ceced61ea29bd3b698683b3eddbc3e81f2fea464e25db947dea8f2754309f1375c13e6219

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
17dfa3b63b5bdce5d7657c5f4381888d

SHA1
523d6c4f34c031f9c1ecb147850e29b3e2381110

SHA256
462ab22958035b63dfbab89e1327ad9314447b51166374f9c7daa4e8ad699afb

SHA512
6f33a9471f35b11a58b471bb97ec8fd183c8ccd39ede7ca8d1de534449215f5948c06571aec8ab405f523ab35f007da57ad441083de7979d8e934663cb76b009

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
5eb83c17d320a70659adbe7a9644fcfe

SHA1
7c9ec0d5e72a5a88ee8c68e6c65ad28e51bd48cc

SHA256
9fddb233e12bee4fef0499027a85b90ca549aca6818ba9ef40ba61d60353c374

SHA512
2d11a260022cd5e051662a8a4cd0542866b2ae25741ed7a64a884b6358dd2e9d3eef650543bb1f3efd01f8247545f737938191213993bd5a32ab2c69c1cfd2dd

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
5f55fb90c5a81a568089e7d7686017b4

SHA1
7a3daaa1f5ce84f22f0e18dca06e70fbf78cf41a

SHA256
d3996e78eaedf20c951c7436aa936e6443d12db458ab4832838e347f4f824c86

SHA512
772918e383ace00265bc4bb00395436d7120298d6d280fa522f40194792e363e45fe383d010f9ea95d079fef72e2aae3d2271dcf7eeaa19fd81b56330ae20cee

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
fb7b8a6f30449278a846b608dccf0a61

SHA1
e6f76d1fe26ae20ee7d56b80de425594e62cb832

SHA256
37a8e314d7827e3770b3167ab232c160583bdfe4be44bd50ff044732526ee6c4

SHA512
8b0b88c676e1a983230df1fecfe27cf89c8157012fec4675992bc0b3296353012ee647e910ba753e6f002e29311bfc4406a8eebe4b1d1d76661bd7667ae9718f

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
66f356ed9bca80e63fc2a533e293316b

SHA1
602bd5823fbf6bde13749c364f300c86a73ad36e

SHA256
89eb035999b7475ffd093e265988da91325e0792b2e0f08cec36cafbdb3f327b

SHA512
b500d10370ed05944553c3fb00c5591fdaf37f2deb7aa48becfa08bba61146e97ddb1e6b5b9c247023551bb25720e8ceffee5ae52e03508c2a6a6fa283508baf

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
60aca9136e48b4aa46a6891cb17fd0ff

SHA1
37ffddb66ef0a3fbb9e1ac6095f292639452dcc6

SHA256
53eefe50a531b0f37bb237db7883df3ef99af7a2c60be7fc491546cd698dc598

SHA512
d16eb9e4215012a2788ddefdd5f184a0cf186a9552d1207238b579ce60af01d6ab11a3b1a0424cc941dd2ffb3a5f469619019024d57c66f6fe8fe6a9a85d474b

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
5c98589f7ea732a97bd67d8ab222de0e

SHA1
5a3c0d743f50427d88587cd9a0299a8b8cd381b9

SHA256
78e347cf89b56a623334653432c68d063ef97253f6c6ab9efc69fdf6f39745dd

SHA512
03d222b192fd4732e3608e76997e48325d09790bb46a51abcb7c624866ade8b9d9ea3d15c737bd8a0e00d856dedb267b2c39332a5cc7837c7d1f9a61573cdb66

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
c568ea3e629cab3a0941b0411df8f063

SHA1
4cb33a7b2d75e8c7a0078bf36777f4a19581ad73

SHA256
65084f36c8f9bf2e3ed8ae0c7375e971e2e62a389c74cd873009dbbe658f47da

SHA512
143fa664818665482f851b76dbfc2e8999c221ec1ec93dcd77ae6400a415641326cff697dfeb352a446edcd2bb0a6f4b1853e107579b53be9dbb2b57032aaa46

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
76f76d96c66326273b5e99ff3847b9f7

SHA1
bf48fe6b93f9de12f9a5197c4360ba9be7ddb50c

SHA256
fd265a7c7cd5a8051ba7fe9d0bbeb6db271475b1c395ad0b45b1e56ad24d380c

SHA512
a5375c9813b0d6d175b920d8c785926001f288b360f772a7ff3205a38d872069f39e83c81aa7aaba01d382d4c85291e69f21cda4818e29dbf5475ddff93a8676

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b637abfe91058cc336dcf287c98a35da

SHA1
3d6c88c168ab7fb4450b758c2789a06efc8bbcd6

SHA256
100b31512e8ff20642a23e768f965fe7a1b08bd51179c6bac8ff892b3ba56c1e

SHA512
5555e24d963cadfc62cf737816779730ebec1e46dd9da11e4eafa28240bb58b84a8b26e7863c81d3d976293848513d002bcdbba6cfce4f1d0b5cddf9985107d5

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b37856900459cdcde349de6f663c1c11

SHA1
c4b446e7cef56a7a1f044c3396d724d87763703a

SHA256
2470753aa87753e56aef59871252a33986c56b47f4f59bb1dd377130d6569748

SHA512
7ae09a1c1be3e0329c7f2c1fe575cb22c2bdd1fb5364286cb2b592c124f5d09f56b6967efe2d4304ef7c18b02a04a309b279938f2f4f467d54af23e485c79b05

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2b87ffbba039f3051f03fd8a6e131281

SHA1
9ecaf3e2a82db7e0c144902a0a61f557b380e890

SHA256
8ad5541659f8e988f96d590d83b05efecf3d33b9c7d0887f5763a06bbba28fe5

SHA512
fbb49c32a76f96a31cf2af8eeb02993bf337e98beab304df7407f516bf7f2bdfd9859e8280a0c53a0fd933f8d338e3e38b7416a4ae0f46655ede7c09b801ab8b

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d2dc9cf605b04c2e550889eb5b864b48

SHA1
61004dcc9c9fd33faf729a7bc4b1744f3be911c6

SHA256
5f1dcccddcb0bbde35beea66d7f5701a823b5bb28a45c2d3e5b51f81d6fc75f9

SHA512
15a5fc4de5fb4fa31abbef42eda3c3174d3e8dad17a6ffe8d80b7d7c44757f0ce88629dedc19b7b7c7a7ef4e982eddba5110ad1053c9dbcf6de39ca64340e0cf

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3653194cc90e1e4c5c051b8faa0c1d3c

SHA1
7d01a6cdf827b2ac662a7e4fc4822c080dd12afb

SHA256
a0f3cba578f1672a320de1342f4444fd5cf5732cb1ada7876a40dd9cb9aa995c

SHA512
75c239c53d3bdc029f19099b03c0c53a0b9f4af7aef94a84aa8af978b8ca0d5cb228d59d3eb02a111eca52d5dabab28b12155860c9a6048075d3483ec01f791d

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9c0b616ca011aedcbb48ef7c09eae83e

SHA1
fa087ca839a1b552b8cb000e0a9d332b45db7d06

SHA256
d12198ba5274bd3bb553f27de5c5d3b2a41ce7706d09dea08bbf8905aede8912

SHA512
e80a543c1afeea059472f65e93d7932516e22a66524dc8ce20f2059d120ae3b907ba8735ff279bd5bb1c4e0fb56b7058255ec78fd76af276bc1cc8dc0d5bf577

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2ecaac71cd4781bc181eee3caed370f7

SHA1
c0cb2b185404c5060980f2d60ff62592c1b8f249

SHA256
e41346a6dcd2577b3357174a81b2c257717b599d2f9271153798ef86e02cff87

SHA512
d33adb76c187e7abdbac16314f06bcb445043368b3358418c090e52552c8d86491b9131987b016dd8de2a736ab7a691564485663920fb32eaba12f5950db03cb

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
519e0e931bec3f5e20dd10061f73e63e

SHA1
66f33815720e9c4f9199a66508ac643565ef19b0

SHA256
ebfd60bbbaf9afeed18cbbb843f39372ff65aaaa4a88be79ba8756c6ce2e295a

SHA512
994d38d7c3af0d69f7a09176a8eca800b0c71c890f69b1713cf91d10348f647a13291203c8e8988be2c2821fbc0341a46f85a358a45d1f4a7ee35d266f667aae

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
14443f5328e50a99a18ea9ff6038a880

SHA1
ce92c69183cf6cf6089cf05a1a1adb1fc5844c05

SHA256
bf6da66321780c16ad97e46a3c60fccf9b287bd191757a5b689b637ebeb46953

SHA512
dd6816f79472f0950ee4b87a3676e4bc785d8a1c0497ea3a6fcd16651946139731cd7b78197fdbc8326e22767954a03c6d94f82c86af65962169795bec427f09

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
eda693142675ddfd5226252409a3dae2

SHA1
d50efa03b318e253d30260ff29c652629d746cd1

SHA256
7639b750711a7a9978f96f90400cc0bc113f0de3e5cb04356be422e5e6c3a8ac

SHA512
38a1af9acfc298d01063a4a390ecc5c126aea278ace1e7f995ff2e566a7e688a1ae3b462a1d4863a558d129c2d9c11ac9ff6dfd5265284384d15f83b10797778

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b0b91cdad61dbc67426ef289fb752bbc

SHA1
ab7a4a2be11383c9b83e1927f4cefea4e4e0b009

SHA256
2c58dd945cf36e990bd35a1743e1e4b451b59ec33ffdecc94654ecaf045e3555

SHA512
1e3697b1f733d97abc77bfa932df60a1e614bef9cd03d3995e4632cfd14435e824ee5b286fe4b8be021ecdfb9c0f71d4e2b4c7736b9ae5d72cd0abee47e7135a

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a29c9e1577341e5c8fb3630509cb3e2a

SHA1
7b06c37f07376101c1b201ebe81aef4ade82d3d7

SHA256
ebeb705643af357713e3ca06e062bf8c40fef09262f6ff4de6bd883ae44dd733

SHA512
013029a214401c0c2597085d1054ba1f0da0a2e1fe1ff6809b707cc513b376c59880d46d0528b8847885fc4adddeb8d67a4e53209de535dad0b8cdb3a96bd8b6

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
78feafe740244bd14696ef37817f0a29

SHA1
fb3afd1bdc2a8eeb59dc611e8e7b7e88fb92e370

SHA256
01c97675f164dc40b2d3ead9de4388f888d87b18a50da2880c2a20b3db1074c8

SHA512
8304c8ed2a611754879883ec60b0454f2133df122a2241a1a9dd613ac8e7ebe1110eef3b1659724b5aef331366153918ecca0c216fae880c7a33ae7f2d514d27

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1261.xml

Filesize
162KB

MD5
461dcb8e6914ac8c3efadaa2ab3bfe82

SHA1
bfb82d565114a505c0dc45a7b88c64fe24c2a96f

SHA256
267aae1978c73f986ab32623d3edd0415e24888226d266bb42943765fbf12904

SHA512
b6e500d7c269c1fa7fe796ded05d3489d2c773f1e02ddc87b99a777cb89f5837b527bfcf4a1ec01a155ed8c07bc4fe9b8ff8c7d3672bc9ee89be09c71bac13d2

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/var/root/Library/LaunchAgents/com.apple.afsvcpd.plist

Filesize
429B

MD5
b29145cf94cd1ef0d81552c333c3603a

SHA1
4095a7b7b982b8875a6256919b7d80c50b0a2799

SHA256
2cac13ffabc18f7010fffce9f31aaacc06e0c5ae898c3faa79d747567ce1e2fc

SHA512
fd0ccb56cb0c5084950ad4d04363ae9919a0bfa76c45554df8a7fe0eb0f8a7ed2525af3b4f64982eedac0f9aaec28b7985b4ce5ec80434fc3cf426cb96b1def0

Download Submit
/var/root/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
21f5d5030af8e59e3c9af72c72d96271

SHA1
33c8cace5b132ea6d6c61aee6549a4594226e91d

SHA256
17f3b8679241585b6880a13793afff1baf97b3247bf868d0ed889d9762a7db29

SHA512
ebddb7a65656c6f6150496f3edb1b7204564357e9a929bb7333fa866cae892b9494ae3fc0a3759eba842a43158d3e3de829dd126cb1f7d0d0127e8f33b4b3afc

Download Submit