evilquest | fda9e3edbc1c3d718bde54a57d6e3980dc355fb6a20a9d9695f451a95a3fcc73

Analysis

max time kernel
150s
max time network
145s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
07/04/2024, 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-07_a09c352ed2e0c8b91f166cf6789fcb06_adload_evilquest
Size

177KB
MD5

a09c352ed2e0c8b91f166cf6789fcb06
SHA1

ed974b05a7427c267af3793bb5708de37b07140c
SHA256

fda9e3edbc1c3d718bde54a57d6e3980dc355fb6a20a9d9695f451a95a3fcc73
SHA512

579aa767298854c34df550e6c8b09e919616cbb4cc825018e0ed76840c691262f3c4285967a37f15707ec3f140ff9aab8df4fe910ab03ea85a6087a812cda755
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9SI07:5SeOQdaZNxtk8cqhSxvHY9O

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 14 IoCs

resource	yara_rule
behavioral1/files/0x000000030008b133-0.dat	family_evilquest
behavioral1/files/0x000000030008b133-3.dat	family_evilquest
behavioral1/files/0x000000030008b133-15.dat	family_evilquest
behavioral1/files/0x000000030008b133-24.dat	family_evilquest
behavioral1/files/0x000000030008b133-30.dat	family_evilquest
behavioral1/files/0x000000030008b133-37.dat	family_evilquest
behavioral1/files/0x000000030008b133-44.dat	family_evilquest
behavioral1/files/0x000000030008b133-51.dat	family_evilquest
behavioral1/files/0x000000030008b133-59.dat	family_evilquest
behavioral1/files/0x000000030008b133-65.dat	family_evilquest
behavioral1/files/0x000000030008b133-72.dat	family_evilquest
behavioral1/files/0x000000030008b133-79.dat	family_evilquest
behavioral1/files/0x000000030008b133-86.dat	family_evilquest
behavioral1/files/0x000000030008b133-93.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 42 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

Launchctl 1 TTPs 64 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:571

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:571

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-07_a09c352ed2e0c8b91f166cf6789fcb06_adload_evilquest\""
1⤵
PID:572

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-07_a09c352ed2e0c8b91f166cf6789fcb06_adload_evilquest\""
1⤵
PID:572

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-04-07_a09c352ed2e0c8b91f166cf6789fcb06_adload_evilquest
1⤵
PID:572
- /bin/zsh
  /bin/zsh -c /Users/run/2024-04-07_a09c352ed2e0c8b91f166cf6789fcb06_adload_evilquest
  2⤵
  PID:573
- /Users/run/2024-04-07_a09c352ed2e0c8b91f166cf6789fcb06_adload_evilquest
  /Users/run/2024-04-07_a09c352ed2e0c8b91f166cf6789fcb06_adload_evilquest
  2⤵
  PID:573

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:574

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:574

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:577

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:577

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:597

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:597

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:598

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:598

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:599

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:599

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:600

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:600
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:605

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:601

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:601

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:601

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:602

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:602

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:602

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:603

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater2481EFE7/OneDrive.app
1⤵
PID:604

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:606

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:606

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:606

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:610

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:610

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.findmydeviced
1⤵
PID:611

/usr/libexec/findmydeviced
/usr/libexec/findmydeviced
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:614

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:614
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:615

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:617

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:617

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:617

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:627

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:628

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:629

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:630

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:630

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:633

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:633
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:636

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:638

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:638

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:639

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:639

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:641

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:641

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:644

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:644

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:644

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:646

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:646

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:646

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:647

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:647

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:647

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:648

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:648

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:654

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:657

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:657

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:658

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:658

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:660

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:660

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:661

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:661
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:662

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:663

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:663

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:663

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:664

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:664

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:666

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:667

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:667
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:668

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:669

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:669

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:669

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:670

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:671

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:671
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:672

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:673

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:673

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:673

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:676

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:676

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:676

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:677

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:677

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:677

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:678

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:678

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:678

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:679

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:679

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:679

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:680

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:680

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:680

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:681

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:681

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:681

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:682

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:682

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:682

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:683

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:683

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:683

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:684

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:684
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:685

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:686

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:686

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:686

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:687

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:687

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:687

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:688

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:688

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:688

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:689

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:689

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:689

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:690

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:690

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:690

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:691

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:691
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:692

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:693

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:693

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:693

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:694

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:694

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:694

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:695

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:695

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:695

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:696

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:696

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:696

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:697

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:697

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:697

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:700

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:700

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:701

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:701
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:702

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:703

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:703

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:703

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:704

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:704

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:704

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:705

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:705

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:705

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:706

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:706

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:706

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:707

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:707

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:707

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:709

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:709
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:710

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:711

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:711

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:711

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:712

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:712

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:712

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:713

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:713

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:713

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:714

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:714

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:714

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:715

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:715

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:715

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:716

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:716
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:717

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:718

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:718

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:718

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:719

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:721

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:721
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:722

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:723

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:723

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:723

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:724

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:724

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:727

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:727
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:728

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:729

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:729

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:729

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:730

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:730
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:731

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:732

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:732

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:732

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:733

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:733

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:733

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:734

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:734

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:734

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:735

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:735

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:735

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:736

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:736

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:736

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:737

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:737
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:738

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:739

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:739

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:739

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
6d07c10a5891143671f9009684779725

SHA1
b4c02946f49ad3cd14c17d5677d2244ab546938c

SHA256
7fb13a0ca0fab55bcbda83fb06cce7d7430997120b2984a4a4ccc3c6f256afb0

SHA512
5c3c219c2501a067f86f1dd83b8de0fb480760928be0fdfb7c03992c0f1badd7bd34d092f05b3f8dd516b1736ca50e97da72eeb971f81200c32ae830b627d83c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
1576bdb8311381fc300bfa35a9dc13c4

SHA1
f780734b383fab2788e873c361126428dcc63d36

SHA256
108294a572bf79932a49d4b9686ed9db2f4b3228c39484055dc207cda11a5c37

SHA512
c5e57ead99eb0c766421841ce6ef4b4d87d3193fb13811f2a8e6120680846f41450301adbccfd0d20f6dc478b853838db5fef3a631bb80d15232b0ddb695f876

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
6016895c8bba49c79a3a855cc24d2da3

SHA1
1a307532fca8ed6a2a4b48b3c6b67d96a8ebdf03

SHA256
14a84dd037b44b987bfe58d07fda396a3585f0ff959542e3d4c5471998625090

SHA512
2a45422f3614b4efe2ffc8d58ba75f0e39cb3c16917fdfc574f08c1d5b38a90db27a4ca04d6135729657620054dc1aaad7a51979bc0bc76ae1d965e2158dddae

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
aad4a75c13f53f93524da14d4f19d99e

SHA1
dbb44ce8f91b7a34473bb08245d8b569c718bcd0

SHA256
a4d4d997e15bced537aeecc52ee279a1d29be5a77bb64eeca236df0f5c036286

SHA512
5308b734ceffaab71550711fc8afb9b3d7b8eda4e15ba56f9035bd1feb9d11de0dc0fca67d20e1131796462fd3e8c1dc1041b0974b412594875936ae2c5edc5b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
fc1eac9b12b140976cd3ea64d66a9dc4

SHA1
8ca7e3a0dd80e70cd6341b323244b11d1203f03c

SHA256
f568a2fa0a145eac79df5d040843a48e40e0bbb9e23892fe91d6a0475f8cb84f

SHA512
6814b7a555f2cc368177ac2d391802fd074191e215fcb3d27f66d32288bde40b32ad183f16393e80c60162734f3e0f359fa7b0251a0b0ef0c6ab91056a584119

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
9cb421c36718ee582e237af0dfc3213a

SHA1
8e077c3d976bddcd5733787f339e6feaab45aebd

SHA256
c35749d7e49fcd95704f8b344731bcb12a7393e45a9465e102a62db83b2050d3

SHA512
cc3659e3199957d0d7971df3ba879c36c87765f71c355d61cd591552255b19aceef311b8cf2d373f8e1307f19b80e481dc8f2603c11e167d6aaaecd6023db7d6

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
9187ba82b3d4532a593444ceed613c3a

SHA1
b07dbeab775d3b223d7be9501fea515acee41000

SHA256
876199f6a3c5e2b45aa92b9023532d066f9207406a7d3081f8b145b42b58c224

SHA512
ca4d3b1b70577010bde20750bed243ae0f762eb8b140121b862f9eae3de8e5c129065d47f5b3b18820349a54dbffff98c805aa2b803d1b9da997fb19ad99b571

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
0bb92c48d796a7261dce3b34b26c8abe

SHA1
652d7512434c8eed3be4dc15a73962b42a49671a

SHA256
25b1c0657ba44b64fc7ccc31aad0c687cb40505d137856a70e8a539875a870bd

SHA512
0c3abb3c1c6ea70c480944852e9e9ad1df0ead3bb7f2820b7c7be30244acce05ba1506df8c84df5c2501bd772816a4b3650afe70b7e4ba1a5c71e3ebcff186ff

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
92af5c00046d6cb0c315e9d60d907ce3

SHA1
643fe20588b75d678e0ca38c3ef90952da72fd3b

SHA256
e1dd80451038f467e86ba44401062c35eaa86b3fec04ebc1cea42b48072d621b

SHA512
2ac89315a25df268bdfdcc72d815cbd7eb42938d17e2b8680316d720b40f78ae3509176e058bf7604625a90e2960e541389fa90ef4d9b1a11c6c6c113bd5fac5

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
be47fd6478db82a6f5a0465114da4fdb

SHA1
64ce0c2cdc1bdd38819395ddb49e4876720d3bca

SHA256
eae0365251ee1a4a013140d151abb0a145acaea874ca40b2f976b235635ced58

SHA512
62934a8ae5c2a9674e1e5f79cce96fc306e3bb379f818f05cebee2878fcafab4d1586116c655bcdea8ef6a0fa45cf4768d95be30b35fa8698425e820053c9113

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
a652031aebec679d000e22a88eb0224a

SHA1
658d2b3a359e34549a9eb17ade841e15b738a40d

SHA256
489fd4800136f38465c4245897e7b5b396129402b513f487a79bf8922db432f0

SHA512
d5a014db5ee658c9b1d37d77b8b773580126413b09fe200d77ba478af6f17ee938901a97203c359a888860bbdb8e224d658b4df1411a3322f96a8b5ebcc043fa

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
e75a7e454fa4241524379b8a06ad0493

SHA1
77cedbb71eebc61707f691f2420bc0ad4a8b5b49

SHA256
83835d6a93591940b13a7be63e8e8a03a91a3de37a8ddebea6b9a005ec25537f

SHA512
bb7cf4eba7de6963c554715ff88640dea0fadef4b25f7f7899bbc7bdf70b2c798ee4a600f929156f24703f3ed2759043f53eec6d7d1d0537bfbd793b3b416bfe

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
b19a02869ed98ef4726ac12832f32ce5

SHA1
4647cc3f0e00b279e6940d50673d2f8ce2fddc4c

SHA256
7f5479ac8e7a2ccfb0a1ac7912a7dda9c23f66bb10125ac7083a96aaece8461d

SHA512
c76fe33389bce270400735f840178fad80976bf3dc77aa8bf01c275914215a6225330ce6a8d3cac61bab3abd9fc39a2e5e6ff64c287a60dd4f708edd3f745f93

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
952eaa653636a39fe4e9d611728e933d

SHA1
e0ca45eabda6cddf4220383d41033d236d8c1577

SHA256
5957954237c4e2ad2cd1091ba89da28018d40ca2470235fa6725bd1e173d0e0f

SHA512
08d6c3c77dda88de6a605cd101bcc92d89c6d51ae0a9825a4726e5154712ad45da4387186dd179906e654484841b3257dbc7fb35cbf7025dd45650eb917d991a

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
34728a670b9eb187727c5517eb480b21

SHA1
0ed6a8692f1c76029972a125cd5fca7031c95dd9

SHA256
7413a2f7e3ea50e460fe0789f672d8c8c987e82efb88a7ab585f0bc98605b33a

SHA512
ae36d52bb849664c49ab8ac2a72419bce1f2a359b0e3a48c57270f78d08b12bc7cf165e894269f8edfd0dcf872f43be55a81b29c686690cb2e8d1b40530e9fca

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
e0c1f714f26530844beef4b79f1db470

SHA1
652822377c8ad525a3d2c932f1e35f5a57dbce93

SHA256
901ac26cd4e189746c540dcc2f4c775d7b1b875fdd2ee0ab6240eb3cfe22a817

SHA512
feca4fccd93cf6be40230a0f38885758f87ffe4acb1ae66effdaf4a23ad2dd1fd23a999d6d343e2a00e3d75b6e597f17b8f4a0be4b8c13aab1416884b44c7040

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
dde8c74e63449b9bcae8daf6f7a809c1

SHA1
6014cc3e3b53b448a73364c70f5fae5f19a499b6

SHA256
e8c8a7dd7bb3def3ac2b60e5088fe7eb6ddc04046cdef5798aa5f4f22c73c88e

SHA512
98b56b97fe66ba2a2658aca946ff9828483e60b4fd5206cd90a1a5952e905a25e2e7dd33bb7c3b371926bf604b50c4692e82d672ac6da5ca0f2872135fab1429

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
285b848594bec224112f545c43863f70

SHA1
96873d0787d75a122df82893f078ae72089918cc

SHA256
00238e9fb26be1ab52e7fd80a0097666f637ccc5d18766a59254b589cff142a0

SHA512
d331f23c33b117dac10a7acdf5af46be28902b1b5b36cbb3439aa83eecda1849a6d9e7fe8d7a6556d1f04ea68f51c86344a9d7f75afaf413bb0bccff054ffbc1

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
2bdd828eb8f433a7e3c63dac1107ce34

SHA1
aaed1f36386ee097e5d90e1eaf1d7711237559e9

SHA256
ee713c263c747782954942177dfa799db7ad8704686fe53b41f36ce69a674a40

SHA512
0efb7e5d4af9bf0314698bf301a407feebfcc4beec1bb11279a73943290e4205d318e7a0c44e821f1c4af64ab9ca7c10205633ded2f9ed76db6753fc28b1fd2c

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
21686a7a99fadb87f4fa3d68b0d9fd06

SHA1
1be2e0b0bd8613c2eca9cf16e67fdfa80dd0dffa

SHA256
615e491cbdabb013a6b5adcd55b04b18066219b5224b8fc30a368a997493d570

SHA512
bfd1a6667583b2e7de45eeb3c1a22aa93ee580f3591166cfc7e61fda7b965a7a3263d76327145f5ef6912b25fefe2ab5feccab98953ac356d0313ceb406e782a

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
278947a50b5469712b9d5ef9e7cd3c1c

SHA1
9457f2906c4db21c64515bd8df638df3d0abb021

SHA256
f8864da7189a326339eef3fc69ee9018be964b63d480b69228753534ce9cf119

SHA512
c307576670427f327d8c772cf955cb15c91ec641c327156fd849d29f3f4fdea06dbcbec43b7c4bf4c3b09c903a4da5822ac1bc32001dc9a7ddf9b59ed26a56f3

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
deffcf8c6665661912fade082f832fb2

SHA1
1b97b5ed2e1be484ca3fa7c90b6576bad884ca6e

SHA256
57d15f066fb530806f05b6b2d1bf60ce28e8453bf4920c48c808b4a610fcf4c8

SHA512
224888e5b62d26c9013ec87e9d6f6d64b704b0b022c29b4bf64830fe1bfb491c2da6a80a6d913f3847d4b5dbea9d387bfa2077fe0642b3cafb1e472f61e330db

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
10aaf95bc0b1e488000b1303434aaa6b

SHA1
7cd27ccb0d2b07b4b44b80418171d510676af4fa

SHA256
75535d9db83066cc9bbbed6ca8a301107db23b2f86d5b9f8fa7d929c4647d6ed

SHA512
76190728358002177beade9eb7a5402255f0e9501f6bbe16e86afa13eabc1798c43da29af4006a6f49e6403578f0c61b820ebf056d969b1c7d8589c237d8e034

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
ca8b5bfcc727717284e3227f0f949eb4

SHA1
54e8351f97392c48854c2eacbc27f2d64b61413e

SHA256
c40407e8850a8c71f8d5b42237493e9565a9b4d8ed25a31a4106f8e5c9eb7f77

SHA512
c5c34e1a00c311180a689d48357ea3b4901c40fbcf5be3cb5da4aa47ab1dc8d8f07ef04283588fa0135be2ac0bf7f5768e0e99b11edf36f5dfb33f75582985c8

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
2ac1b944dfb3bd4713e825b7f15c5527

SHA1
301b4db103ecf946ba01571d58b216e5da1ba0a0

SHA256
e44a98ea6883524f3ae83587a025d0e2fc9b90b62b7b8e1114efc5bd330db1b3

SHA512
0b7e10265b8d0cc7d2bd3dcd4cfa5b84451614a5bbe43f2ec73120f96b314413b6f28e15863268ca5455f26b5ef047f23de2c131985590ad53fe3365cb988be6

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
a4782ebe4aed5c66b682306b75f8999b

SHA1
3dba972cbd81b0b7bb2743d37a92242cc5a045e3

SHA256
6a261743e82244effe3df69f70aae8158e455392cc870d8d9bd3afbc6192f615

SHA512
de465e4908e1edf9f214291c0e839743d25e5aae841b0c25ff53defc43dc4d9f4595ccf0201b0f37ade66a444ed2a91abe2ee91b4c6b4a1ee1373ed5b3a95e53

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
af81d21f1a8f3b4beb03426fd5ae0560

SHA1
3a85fad971286ac7e87a16effade1b8ab98bb508

SHA256
2b2382096b5a3d4f77bd0ab32271e08ce0516f379e3e8123f89afdf367b2905b

SHA512
c9ca82abc54b2eb0591f55e3fe750688df6470c946e3fb185c5ef17c2671e3d834a3aee31b0aa09e883d8c93e78431513d372b6ab245c327083140b4aa608582

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9d6d6c0c681ca8c98cb84583fe8c7167

SHA1
91042b42ec45469a17486134529fc2ab109c3eee

SHA256
a7ca78b069e6c5696a4135dba4fc391bb0576506a7f124844e565e1c16a57782

SHA512
67b4add68535ffe55797d81e17fbc22f815857a930775f0d19fd2f7309bee7ddfa36c562fddf719449544ea26e855c76f106b4fe3a29fbebeb0ac3b48e4a6587

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1c79b099fa72b4ee6a3284476b467a98

SHA1
1e7ff701f8aa6459a5cc24969a01b67061a27632

SHA256
7bca1adde46f23163857baff031327afb0958f9dd6667bad4933c72d05745c73

SHA512
de7a7e06a336ffe3b5ada7b2173f35058353d2b440a30d690fe09d37ed9c14b643c2d2ad195550e72488150b97c8d1ab3556e1df7a05fb2c6d10625b9a2bd3fe

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
5c38cf245409bec87352a9dcfd0c6b42

SHA1
5b09f9531dd81d6afc74b2bf4f6e809acc0051d2

SHA256
da618ccbc3288e9a2d165487ffdc852b0d18b98ae72392014f338114bcd97061

SHA512
49cf4c182e0dc5ae5ec21292872f35563d66d6ce10f035494d87b354801d909fb4f549e884588870ed261be33de91801afdd251d87ab4c206d3a801bd320e353

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1ded30a82b0c90c58d7719797543348e

SHA1
94282c13e834b5f02858b7309b9e9e2dcce02abf

SHA256
71770a7c2ce5b26a0b3342b666071de144f1abd2b63b4d30061c55d460d6397d

SHA512
3b19d11a36ce51620df0a3fa7db1fdfb266f941b57408a32ee174afbfda63bfb72456a8a7c9375741392c9d441df4414ff0e6f98982d4b031642e2769334c991

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
677402d88ad79aacb70f6a9b7e26ce2f

SHA1
686ccee4faacaba03d7bff2d651cebae18b2ffb5

SHA256
8cc4985b87e98439e6f8556f4df27e972453b7a04f8bba154dd238aeeaf6d3e1

SHA512
e1374a174f6813fe57af37a915564dbfc93135e5c1cda587511d39529a7a0e90fec72f194f76ca0f46efb78cbd7fd6d59f37006d43628d6a4b4f03fece778fbb

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
97c60d344f53be1d87e745d327d420bb

SHA1
f15529478b73cd38c1036711fa8b9c0e901b5d61

SHA256
243b5b735d994956c4a41f4f8856ae1d2012729287f99c159a3ef3628efc9803

SHA512
309b7f586fbcd3c9e3654bdc23a20cb743c51b40bf5dcff2f3d66d96271baa90a25d5fa8a9670035d92e210a880ed0b207743fe04b769962384b514dcefab47d

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
073822707369ea708ee0166e6d63406b

SHA1
b922fc4b5cc4124c71a8058e9b54873d5b4ba103

SHA256
896765834ab41363069e758cc8f7fac05fb7d1a5b69d9da05a0ecde395de5e86

SHA512
bf209c57ddcbbfd8f0e165c5073891a0d1d09b9fcac93e8bc27a20913416698739e149a63fb9650e6f7205b9bdbe00aebca56e49c25f228641f3b6c29d8b9a70

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
03e8bd755fc73049937748b058ffb524

SHA1
277f3a7dc713a03f67deb5c1b7d85f9eee738dee

SHA256
b52c11bece43f9278d9c61c1b478e25105d2044a798f41376873dffda135271f

SHA512
8223955fd8e104a5543d0ff49d3aba9db61d744fd736a0e0d47dc93cf947d7f1e1abe7252732a12aa8e433e83cda5eaeeea2910912e0e7b450f721f3287f54e4

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
53f66fa04ff6e2b1df87c732ae04ce72

SHA1
c0ffc29810689d825427cb7a38f96a37de827d1c

SHA256
fc6ff84f60d13f7a41fed4bab6f55690e8c534454ecb0951e198ee7af3622eca

SHA512
58c32d9a764b88afd156fa10cd446f0715075b00e8050ad13b5b375bd4fd5746b75cc25477c9cfecdc76ad794e184cadf24a2994d34b3ecc93e20fea7082ce25

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
7129046126a075529979bed96225cd82

SHA1
92767c153b9d56342085be7ea1c795b6b53a1503

SHA256
4c578b435ba85e4bcc35244cb147af8350fd7119bfa7b9b7cb5be2f2d555e18d

SHA512
abac9ab64666bf0d51e1633d392ebed2cd80756c3070e86659df440ba05dd14adbafc6767d006f8bc98faf2382d7807e58970cbf85b8410072f13bb105198c7b

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
0ba0c1eefde4870c4fa982b85b75d394

SHA1
bf509a337598177246a6934d0f7e586a5dea11de

SHA256
0860bd75dbe03530c14419ae897aabdcb6d224092ebd637424aef52295faef77

SHA512
ff14478530ca050a4f524f4ea1d20c7f85bd7f4efbce75930bd396867fdbcef4cb45358c2c93db7227f7b1467782c15c9c670cf4d0b12c7453f9ce92e2ae94aa

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
7edef5e7fbe094da7a2ce2d1d84a5de2

SHA1
ee017aa9ee8e08b4d52e6256698cc2640078fd1f

SHA256
647322f171e9d2d29dbd87b32ad541caec8fcbec0d72b687abab7dd2f00fdf73

SHA512
01645b3a7a33ca61063aeadd91f3083b31cbf4fbe44b9a387ae711fc1043c720b7eef2beeab15d75c16f1b2763858efdc8527f6ddc96b677c53e5d42b6b63de1

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
043ef191d15db1d7543603ac2727c7a2

SHA1
0fe0bb64b3c53c9423d274b69cc1e61778a71747

SHA256
c6576212c27d1361c85489e2a4926715c12815e1cae3850d278cd52ff2f151a7

SHA512
5fd98d935614ffa125b42399d6285df3c80512d2cf4bd011a0f8b510cea9cd4128ef54ff593cbcf9104d6ace7c27889bc06b2936de65490353707ff862c09491

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
817f506550d42140696874d4163ae23b

SHA1
2c1305fdeeb1a0eb1e4deba9a713a1744a1281ca

SHA256
99b14529ee65cad020990bde41026656022c3954c02e2173000a62ef537b44e6

SHA512
f995d9e46c395a21e182776c0fdfa6d9ae6af9ac35e67a233822402729e25db2fbbae97635906d8aee890605ceac2d4b7d5d7756e97fea3118452e2e36b95132

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1261.xml

Filesize
162KB

MD5
461dcb8e6914ac8c3efadaa2ab3bfe82

SHA1
bfb82d565114a505c0dc45a7b88c64fe24c2a96f

SHA256
267aae1978c73f986ab32623d3edd0415e24888226d266bb42943765fbf12904

SHA512
b6e500d7c269c1fa7fe796ded05d3489d2c773f1e02ddc87b99a777cb89f5837b527bfcf4a1ec01a155ed8c07bc4fe9b8ff8c7d3672bc9ee89be09c71bac13d2

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit