evilquest | 7c361a1cc80897e9d88e5dd18bb8515d96bf00c6e31f20eb961a03503bdf9fed

Analysis

max time kernel
149s
max time network
153s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
07-04-2024 03:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-07_7e50cb59569c5adb3a39ec315b3ed8ee_adload_evilquest
Size

305KB
MD5

7e50cb59569c5adb3a39ec315b3ed8ee
SHA1

3182a7e995ff740c40dfcffb7a3752c78e0e24c4
SHA256

7c361a1cc80897e9d88e5dd18bb8515d96bf00c6e31f20eb961a03503bdf9fed
SHA512

76276f7ad273d70eb16c52b2f9db50f28cf262fb644117327051763e7fd74feabcb1892ba5de5a176ab35d1ad96d9233370022e0d5a49d9b4bb8d98005293f24
SSDEEP

6144:5SeOQdaZNxtk8cqhSxvHY95755Sx8GpdlXmVkO:5LOQdaDxq8cqavHY/75kxkj

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 14 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008b12d-0.dat	family_evilquest
behavioral1/files/0x000000030008b12d-12.dat	family_evilquest
behavioral1/files/0x000000030008b12d-17.dat	family_evilquest
behavioral1/files/0x000000030008b12d-30.dat	family_evilquest
behavioral1/files/0x000000030008b12d-36.dat	family_evilquest
behavioral1/files/0x000000030008b12d-43.dat	family_evilquest
behavioral1/files/0x000000030008b12d-50.dat	family_evilquest
behavioral1/files/0x000000030008b12d-57.dat	family_evilquest
behavioral1/files/0x000000030008b12d-64.dat	family_evilquest
behavioral1/files/0x000000030008b12d-68.dat	family_evilquest
behavioral1/files/0x000000030008b12d-79.dat	family_evilquest
behavioral1/files/0x000000030008b12d-86.dat	family_evilquest
behavioral1/files/0x000000030008b12d-93.dat	family_evilquest
behavioral1/files/0x000000030008b12d-100.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 37 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

Launchctl 1 TTPs 63 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start afsvcpd
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\""
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "launchctl start afsvcpd"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:569

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:569

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-07_7e50cb59569c5adb3a39ec315b3ed8ee_adload_evilquest\""
1⤵
PID:572

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-07_7e50cb59569c5adb3a39ec315b3ed8ee_adload_evilquest\""
1⤵
PID:572

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-04-07_7e50cb59569c5adb3a39ec315b3ed8ee_adload_evilquest
1⤵
PID:572
- /bin/zsh
  /bin/zsh -c /Users/run/2024-04-07_7e50cb59569c5adb3a39ec315b3ed8ee_adload_evilquest
  2⤵
  PID:573
- /Users/run/2024-04-07_7e50cb59569c5adb3a39ec315b3ed8ee_adload_evilquest
  /Users/run/2024-04-07_7e50cb59569c5adb3a39ec315b3ed8ee_adload_evilquest
  2⤵
  PID:573

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:574

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:574

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:577

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:577

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:594

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:594

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:597

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:597

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:599

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:599

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:600

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:600
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:607

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\""
1⤵
PID:601

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\""
1⤵
PID:601

/bin/sh
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
1⤵
PID:603

/bin/bash
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
1⤵
PID:603

/usr/bin/osascript
osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"
1⤵
PID:603

/bin/sh
/bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
1⤵
PID:604

/bin/bash
/bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
1⤵
PID:604

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd
1⤵
PID:604
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd
  2⤵
  PID:605

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:606

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:606

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:606

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:608

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater2481EFE7/OneDrive.app
1⤵
PID:609

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:611

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:611

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:612

/bin/sh
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:613

/bin/bash
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:613

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:613

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:612

/bin/sh
sh -c "launchctl start afsvcpd"
1⤵
PID:614

/bin/bash
sh -c "launchctl start afsvcpd"
1⤵
PID:614

/bin/launchctl
launchctl start afsvcpd
1⤵
PID:614

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:618

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:618

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:618

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:619

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:619

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:619

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:620

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:620

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:620

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:621

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:621

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:621

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:622

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:622

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:622

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:623

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:623

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:623

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:624

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:624

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:624

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:625

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:625

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.findmydeviced
1⤵
PID:631

/usr/libexec/findmydeviced
/usr/libexec/findmydeviced
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:632

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:633

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:633
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:636

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:637

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:637

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:639

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:639

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:640

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:640

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:642

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:646

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:646

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:648

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:651

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:651

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:652

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:652
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:653

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:654

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:654

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:655

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:655

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:656

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:658

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:658

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:658

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:659

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:659

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:659

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:660

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:660

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:660

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:656

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:662

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:662

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:662

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:663

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:663

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:663

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:664

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:664

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:664

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:665

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:665

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:665

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:666

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:666

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:666

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:667

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:668

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:668

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:667

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:674

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:674
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:675

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:676

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:676

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:676

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:680

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:684

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:684

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:686

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:686
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:687

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:688

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:688

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:688

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:689

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:690

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:690
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:691

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:692

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:692

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:692

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:695

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:696

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:696
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:697

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:698

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:698

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:698

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:699

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:700

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:700
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:701

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:702

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:702

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:702

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:705

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:705
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:706

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:707

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:707

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:707

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:708

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:708

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:708

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:709

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:709

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:709

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:710

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:710

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:710

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:711

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:711

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:711

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:712

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:712

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:712

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:713

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:713

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:713

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:714

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:715

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:715

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:716

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:716
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:717

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:718

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:718

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:718

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:719

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:719

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:720

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:720
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:721

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:722

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:722

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:722

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:723

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:724

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:724
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:725

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:726

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:726

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:726

/usr/libexec/xpcproxy
xpcproxy com.apple.gkreport
1⤵
PID:727

/usr/libexec/gkreport
/usr/libexec/gkreport
1⤵
PID:727

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:731

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:732

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:732
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:733

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:734

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:734

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:734

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:735

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:735

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:736

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:736
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:737

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:738

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:738

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:738

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:739

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:739
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:740

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:741

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:741

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:741

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
fa0d847d02ced4e884571f5954d726eb

SHA1
2146147238aa58951b3659bde6cf50c3460284ba

SHA256
4872866759e63b60f9afd75ceeaee25e78c766ee77b5f15e7a4397890828cc90

SHA512
6ba13c9a4b1c43dee9af149a0de6138fc7f52f97b879fb539e7be0b193b5ef2e77abe2eb4e47712e6e347d5d2ca24dc6b2e15179dbc47cc48d99f934cc9d7c3f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
158B

MD5
69c9b3a0e7a6990cb4d47220a250e6a6

SHA1
0423ebc4264663fef6ebd60c55769c804eb6f899

SHA256
5cefacdda2bb90fd9d1647801f8f828ddaaebd40a4c67aff72f8634a7fae098d

SHA512
5b89f108de455b2f0d3db554035d38419a56632b0a00c3d21867a3dea40c6aa572672b91a265e5c42f987c2a8f866328fab52d212573785de51dd2a136ce9808

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
c8661fd561295873081f26dce4f8c3ac

SHA1
6f11012b9f27a5327494000150328d81f65f0c7c

SHA256
5728d7b262b5bcb88655dea368d9b95fb2372a30d07430b6c18f7dc5587a77bf

SHA512
d927690aaa8bf0c42e810c4db646becc2cf729299f25b7cef44aeac1a7fdb9ce86f35df2eaddd59e89519b682290d81d8adc9ccc5c61e00187c3b38716b24f17

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
a3afdc38ce6ce45a2e8141534f6e65a1

SHA1
f419e76806732883ea724612ae8e3cb49c88907c

SHA256
3a56069dc56062691e96a38ccd98f59bf2338f1c795ca78d2c3bd188ce2fd052

SHA512
03642dbf86f4ba8c67faefe10f5fadc0357580c219920bab0d2e1b87932ef662a986c4ddc5965ccf6821a8a314f024ad3065ddc6368eb852c7b475afd1ba4476

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
16b8542ae69a3a0e494d235212b29dbf

SHA1
94310b228467a36f209a852fc8c390be360e83c7

SHA256
5ef8367582b3dbd532df20d795eb0c67d4010129e909c1a942c4c2308bcf18bb

SHA512
62d4f045d62a712c30204b3455be383c56517425bf5b64378d2227d5a2315d5883fa83ec1ab076ae7a98026be89f20f0a1e8b46e95f9a6558f91e1b928a721da

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
0389451478135865d7fce8d4a84ec480

SHA1
8e0877bc07888e837232ee85369b8f3b1fa8edb9

SHA256
0d3d0617853ab3d2cbf2e595d70ab3a332175313735a9041a18f8b2981ef6f93

SHA512
330b39d1eff674dc70c96bbdd2e6392af7d64c88c4dbd81da77f91a5e56bec61e0c1cfdf56ac1da64cbb21eeb5c20a8b7fa5e4739e474bf6ec724b49ca06465c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
357ec879013d8c85956c4a2d4fa44aeb

SHA1
33dcc66167028d48edf49cc2ecd3b72c8cc06f48

SHA256
256e3c3b1a25edb5d6d23f17a6508523cb1fd79a450c6f1aee3a9a5d5b330de0

SHA512
e4ba896c04c672a3da33be23f5798c628a2280000d4b069841f2afc8c33cf0fb99cc4f31db89fa9ee9a86577a9c7988cbd2da90d771791775cd022aed871c01a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
b9b507244c3c24518a77945f6169f488

SHA1
b7bef6de1c1757d2237d167a54c869f605ed22a9

SHA256
595e59362dc9b192a3f2b12e59a12c120ab8ab47e505a45f9f9a9f6369d9ee81

SHA512
bc186dda1ac9ba38cbebbc1e594e56f73cf74fb3d9d16b50e741e6a14033d17ea893906cc4191815b9f68b8e89de200f5f532b74c589410cd6070128f705f41a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
f8cb1aa314ec9a3f8523fb61e2288a26

SHA1
e68e2463810648672b0df3b293f411a852ad2304

SHA256
2e48cc2d758a309001e876a5ab6235b0fe71b42dac0e48eac691cfdd3891ee84

SHA512
190d70024023edb6a12da4789fb085987f95ada81739b092d46d7b8fdc6ee454b6b01e7a39302f4ff65e21d06dc5ecc2dbb111a3b9776c758078639d5e0a9503

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
6b6d028e94ec17966226d52617ee1a5a

SHA1
32b8539ad877b654d0a1c5fe10c8287b46eed707

SHA256
7e7b543df1a2abe9e370ae92ed1d85b0813105bbd89c0b80ba8d398c1c764355

SHA512
12d39b5c187c8f14ee182bdc742912e3da4d9fad9d22c8d5497ae0bee5ef81fd231c6d14eb4ee12c7af04545e83bef7cc8b78a8dcc626876656fbd0b4d1e5bfb

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
0c31b117497db3deff2b87c0b3b19f5c

SHA1
3cc7653c9bf4b5aeb8f22e999a26c9aabd920a3b

SHA256
f9bfa933caf901f8cc0214f6963feb222b72be2ea1630218254be23a0f85db42

SHA512
c25107d7a45f21d61353ef2afc429571dacab225cfcfca204156b69d7f0682e8a79239548299dc772ac8f3dd7e736ffa05500a6ead9273a608e47a96bf21c2dc

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
6b0c48a588dc8d365872d788e5b62495

SHA1
83871951127907e33d5ff5a699940cc064df53e7

SHA256
ad3bbcde175508bc37715cbdfd1d8ee5737ff81a4d69f3718a78e1588acd70c1

SHA512
452ed7fff506d7fc82b62776e0d4af1bd85884a9ef1d26d07b56ed28a543db3c48f663f517f1c435ccee58dcdf94c81657b97164cd383a5e1db38de4904d4be7

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
3803d88aadc8768da9919e1d8f026f75

SHA1
7030607fd625997d9799019fe2893542067c23dc

SHA256
9317bf730c5e396543fcb1ee28fc1afe473a53738c24916be2d9890ec62cc84e

SHA512
8a7b7cf815bc0982f416709c07cbae959b1d8b4daa6ce9aa81d8708404646bf32c4116e1d2a405d491bfbca554c5e8b383be564003cf3ea645a3915a7939a9c8

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
4cf69a936905ea676229504469c6b00b

SHA1
a2947487c39a39c3ca2db5a326e515cc0d2eaa10

SHA256
3c34a8bcb43ead71b471c1b7088053d0e678cd6ddcead2e813436a115cba142e

SHA512
7f3d4c8f397d741c6747acee8487777fc421bffb7fcfea7219bc54b56a3a9e97570e3b9421b5f9128c95d41d38bd37e038246f2ec9b6334d73d0d38440ee98f0

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
2b81ba80a125c1040d9766d0bb93e892

SHA1
cb29f041296e8fc8f815fd4dfd16550bdbf28180

SHA256
10e0e8d36d1e1bda8bf125b86a8f7896f4b892b8b714348e0ea9e20ac21a209b

SHA512
e6592f65f03dec2815a206a93e14e3afbddf89f166ca561a267fa961d9221aed0557d6d9121d9a3ca16047cefa96fdd11f171fb600c7de205e512ab06418bbbd

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
4821c94b6ed898739e80e65e9a6d5c22

SHA1
1d4952f1b38a8478654de4801d78473feb3e7b98

SHA256
13c90b68054bd8fe2f59826907e909d6f4ce828911703e6577e7131224a8ab5d

SHA512
12778075258ba1d2ecc6ceeebb54ebc693530c0dcac82b059804590a266416338fe33a9c90f9cfe0e56d6cb6c3f07625256959c3a8dc13b6ba1b004faa8c6880

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
9de9d9d00fe327ec0cb6c9f58a7c2bd8

SHA1
8c32aafa80119746af2b578eeb76928e458f9577

SHA256
6793c07d9b500c6dad8e6d5dd6da5f9fbb3e01d1a5fa21406964d90807a4bc6e

SHA512
30f5a0ae86067183a2a038a9219d4e0c534c20279c4a9215b0cbaa92f4215342b864587a673403863a60b5cc66531c62b7e6d814a8008a5e8d908dfe344d6a36

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
e25966a4ecff8662599aa2e2174b63ff

SHA1
e0266df8a4ad0556982ddf58ad8238351f51ac57

SHA256
68adff9c28ad6539d074957024a725296e3048ecb21d66822b0c8b8a00b14866

SHA512
ef19c858986ef3cde63ffa8f02eafac3db35e62dea43945d329615fe1fe7ab9afe3cf71b16724a23ecb79100e8d7e4981cbcbf5ba8b06b69b7e262d0ed906b9e

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
6267c19cc20d068ef1045fb77ae00bd6

SHA1
f3b3953ae89e486caf617a729125d72faec7c5cc

SHA256
ef79b24754e79a3f5f3a33427f94a2376a6d8fed656fb66f0143f612cf96075e

SHA512
a3ff93506b39cb3d53bc30ebb711b1f11e89daef4e6be1fc20b1e6820b535b7be34cc0a7a71cc3966483c028e76fbeaa9bc35ef0d3c395716be1d99fea5094ad

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
52abbc5bc928748d229d4504310a3b12

SHA1
4e73433045c152239adfb699028e45b8ddcc0b87

SHA256
42c3ccb85b876e73817bdc20e2912374f348a65f39e1949fcec6e40c96e48de3

SHA512
aa4140ebd40ebf88e0a5b29e5d324a4449f60769787577457a3b15150bc4a9497c41799941f356c1ecc41ea9096eb04fae43e9c88e2f2eeb5184d56c9ed27d60

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
74bb585a2979d45b4c5ee22563985990

SHA1
dc60f462530504d89e26c4da2b5d92742c28608b

SHA256
4ec0961166222d7ae4a24054f670d2d80768e842aa3d89dcf88c5417583511b0

SHA512
df6537fa93b3983b2681531ad1f99e81fe2b4fdf6dd0cb4301ca4d0953bb42c0ad6d5b907f660bbd03a5dcd81b056a03a3855252ba1f34023fb1e635663df3d6

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
93010ceab520ba44ac609145befc07fd

SHA1
24998344e35c4a021a4d553b73b1197fd8074873

SHA256
e1d5b48887b5a91e35dd7ef8d304a1e87e66c0e787dcd3c1a56de2f73a11ef8d

SHA512
75a0befbe0417cc4bd9ad70b47abdc0f9b469c6397b60700f88cdb623b601dc148c7fb364527ce1f33a013da6db1c013ee2c9f7f33909819e4a9140bf8aa6eb9

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
d7606460859e8dfcd7b01212e853a384

SHA1
a543132f9f6f39f372d09695f141281e14a6fad7

SHA256
cfd18de788930808a4d3f7ad591d08a9d75feaed14e8d19d7e01935f622c4ca2

SHA512
db7c510efab6bb49c6992b8d4ad15aa73e0349f72f4c95aab16a074cb79b797c43629f1077b790aeb6304f1b75e0e1fcf80c0e1bd41d084511890b0af479c0b9

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
80586c8120f17ef33982541a38f68ecc

SHA1
a1ecfb96c7f9c1960137186f0b321f9ef9a05d26

SHA256
52dbf6feebcf3b729b785d9923f872d158b5e0a38e8f6948c5c4800e66359a52

SHA512
5d7acdeebecf58ecc05e28664c3ade75d39304b10e1aea1267b0eaa934f197402816b7c814f83b133038e8abbcd90e1ac951e3f72dae154cb0583a9c6129d6e9

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
145B

MD5
420702ea35d4d6b935506e15a5e5e035

SHA1
d31006837b8ef876f203faca38dee555c0be8bfb

SHA256
11ca36e718042d168c6073506f172ce4fa3028b9ef59a3d9a374da79ef02d846

SHA512
66ada54e306f9c224683c171ae217d610cdc7f4429704d5bd64abdf19219e7713e2fd4671639732f89074b38909d330b13a4cfe990862c93db054373bf77b36f

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
733a9b115dc752019c7353ee60f3dca3

SHA1
9e3d89898f26ea821e5ac5b0deeefefab1196eb8

SHA256
49473dfa4909ca27224aac78d4bf7f74b4947de6062dd05224902ad1359a1e05

SHA512
3adc8514da0f09164c1548eb2d374ca519a1f4752a64c1acb80e104e749ee4a9e89ac04c90c0d731651988401b7406ec473be421380b0010e42160d43cdef2de

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
e1070750b7d4eb139520bfca219359f8

SHA1
f101e8d2a6a43e2a25ebd9c9ca8a08cf3349a6d1

SHA256
7f6b20803590163cb34a60a5280ac6a148690e2e3a53b9fd77346ba7a68ac30e

SHA512
10f540928730eb147a3b36fd916cd39c44377577451060b2610714e13d168d032fe15c46e1990c3a947ada064c94636a1674aee0ceb19acb162cd16458f72e70

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-04-07-035012_tests-iMac.crash

Filesize
41KB

MD5
877d1e5dae3d666c317db34c157adb63

SHA1
4b1a000ed13f894f04ab878b61fdf39d167ce481

SHA256
f874eaa071cf1d94660113c9b016e98f676d102593b5e616bd61ed0c82b0ceff

SHA512
e1286d2693265c071b840cf5aa5faa8c7729a7e774c6c528156303ef45a169789d816eee7247834b1f83cf31bcd054305e74ae0db17afebd973aab38285b8f52

Download Submit
/Library/Logs/DiagnosticReports/sudo_2024-04-07-035142_tests-iMac.crash

Filesize
47KB

MD5
e0223e679a5f1d2e55331ca6b1d8602b

SHA1
ef37c78f141d0f62f6518fdad1c710486419c06e

SHA256
17767d467c0486eaa644cea9ec29ef0fe1683f6e0d1d4671d999d745b7f8ddca

SHA512
71a58e7fbc48d1ae8e5cc41e584c6abda9f1cc6143a05614ce5c69a8baf409fadc90d8b8e25df8f6ca809425a7df1a372b789db7fe408c6435f1e3af606134cf

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
53add47691912b5d6b1a3fd8e0eb9f1b

SHA1
4bebf996b2326f53f8668df48d152996cc1fbf92

SHA256
592a5bc971094007a74e45b98d82cef9c7ddba66ea9f7c7f4caaa8c55960d477

SHA512
f5ece0cba3fa4424a3e5038e87096b018e19b2576508763fbb2f0b260a0af33d68b193e717ba5b9a9352912814581e855264dc3168e9658b9bb5040c5b6667a5

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
10916bd9eb7f6e5d998f704c5db2d766

SHA1
7bf721009b836bfc655f003e6924b914c9e7c660

SHA256
af0cbcc2d33c7a3d96908649ceb3046ad249bf9c21b06ddf44d57878d8df667d

SHA512
50f4e5a59fa23655be46fb5d5de9f8fd68f661e1447efa95b1e4598c8c3c317e9e3642b6059c27981d74b055c4e151edc225248ae9a573f46411e0bba05165d3

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
5c988d1728cdbb8eceb2fa67e24dd5bb

SHA1
3d3722c9744c00089be125b54af87bc569f9d94f

SHA256
cde6d108670648938f74c3fff47ba07cdf2e1064214cadcfcc592449a6d6581e

SHA512
e069956cdf9206ed4b3a8fce3a21ab0cc9f10894ade9b22d810e4bb18dd171841bb48a88b2fffe4b129ed8fb413d4aa0c94c68cad65d38b1f560cfe286a94b6c

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b16389644f24bf0ef5b6d7a4cf4de7f7

SHA1
37c3c645db2ef680e0590448aa68bcbfaeef803a

SHA256
0ba450ed64afa2c6d8faf1ca96e48bca53e401f83784cc354f7695552e512713

SHA512
a9c0adf16e497f4e002c5dba70a94eb74bae87fbebceabfc94815738d401a5615ad3ab1b098e63b380c499b76a3d2599ae388df63100a8480f326ac7cef18c45

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b3a5a2b3c3f30fa07bbf6b3cb76af1e3

SHA1
f2d60a6898312332b17410c00cd5390c95b641bf

SHA256
e32dfbab4bf8445074013ba0822a0812b53d902f2db59789fb434419f3762f1d

SHA512
7f8c20f134fd7097047651a3fbdc365ba110f6529b99eb31f66768ec16387f01744d13e3150f13018d94d52d59270a2cdf95c9f7653df76b2f715ead3a101751

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
23b8f425b09a7bda10659e54eec586ad

SHA1
16e456f28a28e46b1f8a25e0b5206efdfab81af9

SHA256
196c1e431cdf3ffbf222818fb7d059a324cbe38a629b16c18da6078dd00a675d

SHA512
01343084e6db7cd230f59b22183f549f2432db0edd3989c348fef7cc4de80e091d5eac7e9c244d85e82b98246fbaf57592d74cca25304d28eb0b01c2ec10cd00

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
59a06c474e0f7ea7336c5ef90aaa625b

SHA1
ee23099ca3d56974df6a2011400553f5732c5fc5

SHA256
65cd78b575ce89eb0525df6278b17d473166539f45a673154e8f070dcdfe1e63

SHA512
2440d4f2ccc147a33965ae7d6955858414d6be557b34feb40fdef3e186964f145908d828487070882ddabfad3997171543a3486313134367710ddbb52e1e25aa

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
0793cc7427021d9771770d531d07b741

SHA1
01e906273d4ea2244294f95000ee300ae3fddd1f

SHA256
45477492073b04820017992883ebf1509c60238551fe0cb702d99dd904b42471

SHA512
953e51c8a13d94255134b4f7e80661666bfd48f0aae0d5c4f11f50d4df04e1a745b18262b65c67487915e159db9376e984cd77f7f0c2180ac2078f914cf78258

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e16f541374d16f3acdcaf41a8bf5364a

SHA1
823daf7da5fef75fec69c09f6a409271edb86e2f

SHA256
275c3213a46d0445be32a1323f02e358e8b63b999e09c6c5f4233cba9cca6671

SHA512
ca5d14b65242f53b2068524a28745d31554f17d6203038edee516edfb6f9e781e25a2adb05bce4abc2687cfab6504f303b995534b0e149021b2b64bd1dbfdf16

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
861bd29c704d8d32455673001fa6d09b

SHA1
cda3db2e0432241c128f342af894198c5e9101d3

SHA256
50ee277b8e61cba4c5172a348d8b954d10ee58a98f4ad0ac730d69d0f4dfebd1

SHA512
11787b016a32d573dbe1aa09db46a15e62b7876a89d556bdfc400926b8e8e52c052703250eb21bf18f8ed516a687521339f063deb59c91ebc9fa5c6029dfc58d

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4fbb68e6cd59dc1c72df6fe7ad938b53

SHA1
ed1e7b4884a38da1eff01a96ea5b39efca9f55ce

SHA256
27ee012253accfdfcd4b51816812fca7766a0fa0a98b0edb5c4b29a223a64f79

SHA512
e9cb71a25100bff0baee6b283f03beb7da1b9e2772636ba544ea79821826797896be59f04771e014248f2856779dea80bff6d72a4830e80f325eace944437fe0

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f216614f03be9c4da1ef5771e2ef5f33

SHA1
74c6c92bdc35e542e06647d534740645f442bc0e

SHA256
319a94ae4e387183c2556b9821482ab8fa6e89b38036dc20f9502ea0080d72f8

SHA512
192af5be0b3d918da4a0fd99d08a45d68e96ff1bfe60ed7b0f04fadadaa18f840beeb90136872a671c410f1f7a5c7235583eed43baa90d671a602018e3c6ca3f

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
deea309bcb605bf1242ad0d40188d040

SHA1
d3e3a9138bf375497920b7e7ad158dca89660f7b

SHA256
ade66271f8bc41e403180099e33a94da05c669ae52c824f445dab5416bd4adc0

SHA512
541897713c181f1eb452747d67fd2fe6d9d8d85b5b687de68c8387f90f36b3187d63e055aa9d1d941666cee9b1e37aa2bf5d29a38b1c24d1718c16d95457f459

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d10458d5bc19e2b864890a2204502b1b

SHA1
d9318ce8901e65b33b3b176f3f19f4840748a193

SHA256
74445f48afa36c325554b849ccfeee7e431272e53b1208685b965569cdb2c378

SHA512
44c505dcfba4b78ece437d4b8e5c6fa2341ffc4b710cc85ac1dea7c664d9bce683b7a3b014e0e0846e7a6ea151f181199d632bb70292bc0ee38d4611c2744c3c

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
dae8dcaa0be2c7fe9a66325c2adc4dfe

SHA1
1dd62ab10ef71c31ffb7f5f8923ac563748fefd1

SHA256
57e3ba744953995cd818baa95c24b4e47b83f57ab409f315b37fcae138cf0c8c

SHA512
1fd30e9a8ba4cf709f0aca2aadb329032bdc72c86abf9b9547bcfa303cc95f8c7f2a5b2e81df472a311ec79e9b23cd6af610fd35b796c79dc553091850dfbd5b

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1261.xml

Filesize
162KB

MD5
461dcb8e6914ac8c3efadaa2ab3bfe82

SHA1
bfb82d565114a505c0dc45a7b88c64fe24c2a96f

SHA256
267aae1978c73f986ab32623d3edd0415e24888226d266bb42943765fbf12904

SHA512
b6e500d7c269c1fa7fe796ded05d3489d2c773f1e02ddc87b99a777cb89f5837b527bfcf4a1ec01a155ed8c07bc4fe9b8ff8c7d3672bc9ee89be09c71bac13d2

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit